4 ms·

How you know https is compromised... Access to this page is disabled The law prohibits participation in games of chance organized by unauthorized persons throu

How you know https is compromised... Access to this page is disabled The law prohibits participation in games of chance organized by unauthorized persons through means of electronic communication. The authorized organizers of games of chance via means of electronic communication are the State Lottery of Serbia and persons authorized by the Ministry of Finance.

heavyset_go 1y ago
You don't need to break TLS to do IP and domain blocking and redirection. That said, I'd assume governments have access to root certificates, anyway, but they're only broken out for big investigations or secret dragnet stuff we'll find out about in five decades, if ever.
- toast0 1y ago
  You don't need to break TLS to do IP/domain blocking, but you can't redirect an https page unless you have an acceptable certificate. > but they're only broken out for big investigations or secret dragnet stuff we'll find out about in five decades, if ever. Certificate Transparency, where required, makes certificates unusable if they're not published... But that might not be enough information.
  - 10000truths 1y ago
    This is a DNS hijack, not an HTTPS hijack. The ISP's resolver sees "casino.org" in the A/AAAA query, finds it in a blocklist, and responds with an IP address to a web server that serves a block page (or a CNAME thereto).
    - michaelmcmillan 1y ago
      Which is useless if the domain had HSTS enabled, which they should.
      - 10000truths 1y ago
        HSTS for a domain is trust-on-first-use unless the domain is in the browser's preload list.
    - toast0 1y ago
      The HN link is to https:// ... a web browser cannot request the page, and cannot process a redirect unless the server responds with an acceptable certificate. If the server responds with an unacceptable certificate, the browser may ask the user to accept it, in which case the browser could connect and issue the request and receive the block or a redirect. If the user doesn't click through the certificate error, the user will only know it's blocked (or the server is misconfigured), they won't get information on why it's blocked; perhaps details of the certificate might help narrow down the cause of the block or the agency implementing it. If the user loads the https page and sees "Access to this page is disabled The law prohibits participation in games of chance organized by unauthorized persons through means of electronic communication." as suggested earlier in this thread, and the user did not click through a certificate error, then the MITM must have obtained an acceptable certificate somehow or broken TLS. Since Sep 2024, multi-perspective issuance corroboration has been required by the CA/Browser Forum [1] and it was a best practice for many years, DNS takeover in a single country should be not sufficient to establish domain control for certificate issuance. [1] https://cabforum.org/2024/08/05/ballot-sc067v3-require-domain-validation-and-caa-checks-to-be-performed-from-multiple-network-perspectives-corroboration/ https://cabforum.org/2024/08/05/ballot-sc067v3-require-domai...
      - 10000truths 1y ago
        > The HN link is to https:// ... Ah right, obviously the browser would still try to connect via TLS to the new IP. Not sure why I missed that.
  - vintermann 1y ago
    You certainly can, but you should get a big screaming "this site's certificate is not valid for dodgy-casino.games" warning. If not, then maybe your browser vendor has been pressured to add some root certificate controlled by the Serbian police, which it approves to issue certificates to impersonate dodgy-casino.games.

heavyset_go 1y ago

You don't need to break TLS to do IP and domain blocking and redirection. That said, I'd assume governments have access to root certificates, anyway, but they're only broken out for big investigations or secret dragnet stuff we'll find out about in five decades, if ever.

toast0 1y ago
You don't need to break TLS to do IP/domain blocking, but you can't redirect an https page unless you have an acceptable certificate. > but they're only broken out for big investigations or secret dragnet stuff we'll find out about in five decades, if ever. Certificate Transparency, where required, makes certificates unusable if they're not published... But that might not be enough information.
- 10000truths 1y ago
  This is a DNS hijack, not an HTTPS hijack. The ISP's resolver sees "casino.org" in the A/AAAA query, finds it in a blocklist, and responds with an IP address to a web server that serves a block page (or a CNAME thereto).
  - michaelmcmillan 1y ago
    Which is useless if the domain had HSTS enabled, which they should.
    - 10000truths 1y ago
      HSTS for a domain is trust-on-first-use unless the domain is in the browser's preload list.
  - toast0 1y ago
    The HN link is to https:// ... a web browser cannot request the page, and cannot process a redirect unless the server responds with an acceptable certificate. If the server responds with an unacceptable certificate, the browser may ask the user to accept it, in which case the browser could connect and issue the request and receive the block or a redirect. If the user doesn't click through the certificate error, the user will only know it's blocked (or the server is misconfigured), they won't get information on why it's blocked; perhaps details of the certificate might help narrow down the cause of the block or the agency implementing it. If the user loads the https page and sees "Access to this page is disabled The law prohibits participation in games of chance organized by unauthorized persons through means of electronic communication." as suggested earlier in this thread, and the user did not click through a certificate error, then the MITM must have obtained an acceptable certificate somehow or broken TLS. Since Sep 2024, multi-perspective issuance corroboration has been required by the CA/Browser Forum [1] and it was a best practice for many years, DNS takeover in a single country should be not sufficient to establish domain control for certificate issuance. [1] https://cabforum.org/2024/08/05/ballot-sc067v3-require-domain-validation-and-caa-checks-to-be-performed-from-multiple-network-perspectives-corroboration/ https://cabforum.org/2024/08/05/ballot-sc067v3-require-domai...
    - 10000truths 1y ago
      > The HN link is to https:// ... Ah right, obviously the browser would still try to connect via TLS to the new IP. Not sure why I missed that.
- vintermann 1y ago
  You certainly can, but you should get a big screaming "this site's certificate is not valid for dodgy-casino.games" warning. If not, then maybe your browser vendor has been pressured to add some root certificate controlled by the Serbian police, which it approves to issue certificates to impersonate dodgy-casino.games.