4 ms·

They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's argua

by nullc 14y ago

They should do this anyways. It's well known to the technical elite that dragnet surveillance is going on— but it's not known to the general public. It's arguably immoral that the site doesn't switch to https by default and give the public the privacy they think they already have.

mtgx 14y ago
That's a very good point. The majority of people have no idea that many Governments are already monitoring and data mining everything they say or do online. Websites should already start switching to HTTPS (or SPDY) to protect their users against this stealth monitoring, of which they know nothing about. But if they don't and if this law passes (I hope it doesn't) maybe some good will come out of it, and it will jumpstart a trend for switching to encrypted connections.
- MikeCapone 14y ago
  So what do you guys do to counter this? Do you use encrypted VPNs? Any specific ones you'd recommend?
  - adorton 14y ago
    http://lifehacker.com/5940565/why-you-should-start-using-a-vpn-and-how-to-choose-the-best-one-for-your-needs http://lifehacker.com/5940565/why-you-should-start-using-a-v...
  - propercoil 14y ago
    check mullvad. you can pay with cash over mail, bitcoin or whatever. no logs, two external ip's for thousands of customers. google it
    - wamatt 14y ago
      Looks interesting, but who is to say they don't keep logs? A VPN on VPS provider, whom accepts similar payment options is an alternative option.
      - petitmiam 14y ago
        Even if they did keep logs, there's only 2 external IPs.
- deleted 14y ago
  [deleted]
- jiggy2011 14y ago
  What makes you believe that? Not that I necessarily think you are wrong.
Ironlink 14y ago
What makes you think that those with the resources to implement dragnet surveillance do not have access to properly signed certificates, which let them Man-In-The-Middle the connection without triggering a browser warning?
- aidenn0 14y ago
  The fact that this would get noticed if they did this for dragnet surveillance. They can (and likely do) do targeted MITM, but doing it across the board would be noticed quickly.
- chris_mahan 14y ago
  If you're worried, just download a dump of wikipedia and browse local (http://dumps.wikimedia.org/ http://dumps.wikimedia.org/)
- frequently10 14y ago
  To expand on what aidenn0 said: It's possible to do client-side known-public-key verification, which would detect a MITM attack. The idea is basically maintaining a local trusted cert list (other than the broad ones in the OS), but using known site public keys instead of root signing certificates (which I will admit are a security nightmare for SSL). Chrome does this for Google-controlled domains; they call it "public key pinning." I'm not sure if any of the other major browsers do it, but it would be pretty simple to implement. Even if the government had a root CA-signed cert for "mail.google.com", Chrome would throw an error because the government's signed cert public key would not match the public key pinned inside the Chrome browser source code. Chrome would barf with a certificate error.
  - mh- 14y ago
    you can pin domains yourself in your own Chrome/chromium as well at chrome://net-internals/#hsts
- andrewcooke 14y ago
  http://perspectives-project.org/ http://perspectives-project.org/ - it checks the certificate fingerprint against other users, so a targetted attack is detectable. (there is also a beta for chrome)
sp332 14y ago
I used HTTPS Everywhere and HTTPS Finder extensions. That forces your browser to use HTTPS on every server that supports it.
- Evbn 14y ago
  These should be default browser features.

by nullc 14y ago

mtgx 14y ago

That's a very good point. The majority of people have no idea that many Governments are already monitoring and data mining everything they say or do online. Websites should already start switching to HTTPS (or SPDY) to protect their users against this stealth monitoring, of which they know nothing about. But if they don't and if this law passes (I hope it doesn't) maybe some good will come out of it, and it will jumpstart a trend for switching to encrypted connections.

MikeCapone 14y ago
So what do you guys do to counter this? Do you use encrypted VPNs? Any specific ones you'd recommend?
- adorton 14y ago
  http://lifehacker.com/5940565/why-you-should-start-using-a-vpn-and-how-to-choose-the-best-one-for-your-needs http://lifehacker.com/5940565/why-you-should-start-using-a-v...
- propercoil 14y ago
  check mullvad. you can pay with cash over mail, bitcoin or whatever. no logs, two external ip's for thousands of customers. google it
  - wamatt 14y ago
    Looks interesting, but who is to say they don't keep logs? A VPN on VPS provider, whom accepts similar payment options is an alternative option.
    - petitmiam 14y ago
      Even if they did keep logs, there's only 2 external IPs.
deleted 14y ago
[deleted]
jiggy2011 14y ago
What makes you believe that? Not that I necessarily think you are wrong.

Ironlink 14y ago

What makes you think that those with the resources to implement dragnet surveillance do not have access to properly signed certificates, which let them Man-In-The-Middle the connection without triggering a browser warning?

aidenn0 14y ago
The fact that this would get noticed if they did this for dragnet surveillance. They can (and likely do) do targeted MITM, but doing it across the board would be noticed quickly.
chris_mahan 14y ago
If you're worried, just download a dump of wikipedia and browse local (http://dumps.wikimedia.org/ http://dumps.wikimedia.org/)
frequently10 14y ago
To expand on what aidenn0 said: It's possible to do client-side known-public-key verification, which would detect a MITM attack. The idea is basically maintaining a local trusted cert list (other than the broad ones in the OS), but using known site public keys instead of root signing certificates (which I will admit are a security nightmare for SSL). Chrome does this for Google-controlled domains; they call it "public key pinning." I'm not sure if any of the other major browsers do it, but it would be pretty simple to implement. Even if the government had a root CA-signed cert for "mail.google.com", Chrome would throw an error because the government's signed cert public key would not match the public key pinned inside the Chrome browser source code. Chrome would barf with a certificate error.
- mh- 14y ago
  you can pin domains yourself in your own Chrome/chromium as well at chrome://net-internals/#hsts
andrewcooke 14y ago
http://perspectives-project.org/ http://perspectives-project.org/ - it checks the certificate fingerprint against other users, so a targetted attack is detectable. (there is also a beta for chrome)

sp332 14y ago

I used HTTPS Everywhere and HTTPS Finder extensions. That forces your browser to use HTTPS on every server that supports it.

Evbn 14y ago
These should be default browser features.