3 ms·

Apple shifts iTunes to HTTPS, sidesteps China’s censors

51 points by iProject 14y ago

markild 14y ago
This seems to assume that the certificate chain in the software available within China is not compromised (aka, "obvious" way to detect MITM). I honestly don't know if this is a fair assumption or not, it just strikes me as weird that it is not mentioned when first mentioning the "great firewall"
- stock_toaster 14y ago
  I suppose they could be using cert pinning[1]. [1]: http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html
  - markild 14y ago
    Absolutely. I wish they would address the topic, though. I interpret this article as if they mean that HTTPS solves all censoring and content sensing issues, regardless.
  - StavrosK 14y ago
    You mean Apple? In that case, I don't understand how that would help. The user never sees Apple's certificate, they only see the one presented by the MITM, no?
    - markild 14y ago
      In this case, if understand the concept correctly, it would be iTunes that pins the certificate authority for the iTunes server. One would still be vulnerable of a corrupt CA. The only solution to this would be to issue all certificates from an internal CA and verify this in your application.
      - StavrosK 14y ago
        Or you could just harcode the certificate fingerprint and refuse to accept anything else. It's trivial when you own the client. I'm not sure if this would break when you needed to renew the certificate, but I guess you only update the signature, not the actual public key.
        sp332 14y ago
        But if China is already MITM, they can modify or replace the binary while you are downloading it.
        StavrosK 14y ago
        Yep. In that case, you don't own the client.
      - phillmv 14y ago
        When you ship your own browser and OS you can prob get away with that.
- mtgx 14y ago
  Bad news: apparently China does have compromised certificates: http://www.reddit.com/r/darknetplan/comments/156pyf/chinas_root_ca_and_the_security_implications/ http://www.reddit.com/r/darknetplan/comments/156pyf/chinas_r... I wonder if China will ever have a revolution, and if the "winners" will even want to revert to a "normal" Internet. The problem is most Chinese don't even know what that is.
  - TazeTSchnitzel 14y ago
    >I wonder if China will ever have a revolution I think, personally, that the Chinese government will just get more democratic over time. It's worth noting that China is certainly moreso now than it was a few decades ago.
    - CapitalistCartr 14y ago
      The People's Republic of China is more liberal now than a few decades ago, but not more democratic. The leaders are still not elected by the people.
  - MichaelGG 14y ago
    China has a CA. But so do lots of small Latin American countries. It'd be silly to think that a government the size of China cannot compromise some little country's CA. It'd also be silly to think that they cannot get inside at least one US CA. Comodo has shown that their controls are lacking, and that wasn't even a directly compromised employee. So, China having a CA installed, while not great, certainly isn't giving them control they can't already get. Plus, why would they want to risk their own CA cert doing malicious things, where it'd be directly traceable to them?
seanmcdirmid 14y ago
This assumes that https traffic isn't being attacked by the GFW, which it is. But I don't know, the app store was down for me up until a few days ago, so maybe this is working.
ybaumes 14y ago
I've got a question for security experts. I've always assumed that government should have enough cpu-power to decode a few encrypted emails and some https connection. So why don't China decode https traffics and perform the same filter as for simple tcp connection? And even tough they wouldn't have enough power to do so, why don't they break down the https connection when it is established?
- StavrosK 14y ago
  > I've always assumed that government should have enough cpu-power to decode a few encrypted emails and some https connection It doesn't (that we know of), that's pretty much the point of encryption. Read the excerpt from Schneier's book, presented here: http://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html http://www.schneier.com/blog/archives/2009/09/the_doghouse_c...
- est 14y ago
  > why don't they break down the https connection when it is established? Apprently they do. Serveral Google domains port 443 were blocked, e.g. https://accounts.google.com https://accounts.google.com so you can't use anything google related, especially Gmail.
- simonh 14y ago
  Extremely strong 'military grade' encryption is commonplace nowadays. It doesn't matter whether what yo're encrypting is a casual email or the launch codes for a nuclear weapon, consumer grade encryption such as that in https is fine as long as it's configured and used correctly. The CPU power required to break it is greater than all the CPUs in the world put together running for millions of years. The problem is that if a way can be found to disrupt the configuration, such as by compromising the certificate chain, then decrypting the message becomes trivially easy. So reading such a message is usually either impossible, or simple.
- mikeash 14y ago
  > And even tough they wouldn't have enough power to do so, why don't they break down the https connection when it is established? You have to understand the purpose of China's Great Firewall. A lot of techies think that it's an attempt at 1984-style total control of information. With this in mind, they see a vessel full of obvious leaks, and can't understand why China does things this way. Blocking any connection you can't spy on is a simple solution to these leaks that any techie could come up with, but China doesn't do it (in general). Why not? It's because the Great Firewall is not intended to be an instrument of total information control. It's intended as an instrument of broad social influence. The Chinese government does not care if you can use ssh or SSL or whatever to bounce through a proxy in the USA to get to an article about the Tiananmen Square massacre. You want to put in effort to seek out that information, go wild. You don't even need to cover your tracks. This information is out there. They can't stop it, and they know it, and they don't even try. The purpose of censorship is to shape conversation, not eliminate information. Anyone with a little determination can bypass the firewall and read about whatever censored stuff they're interested in. But the vast majority of people don't have a little determination for this stuff. They might hit a link or perform a search, but when it fails, they'll just move on. Thus, while they can't, don't, and don't even try to stop people from knowing about these things, they can and successfully do stop people in general from thinking about them, and guide their attention to other topics. China doesn't care about a few people using crypto to bypass their censorship. China does care about attracting foreign business, and if travelers couldn't connect to their VPNs and secure web sites then there would be serious trouble with that.
so898 14y ago
According to my friend in China, the App Store is still too slow for him to update his applications. Apple really should build some CDNs in mainland China.
- est 14y ago
  Someone must translate this. Why public cloud is so difficult to build in China http://www.pingwest.com/why-public-cloud-is-so-difficult-to-build-in-china/ http://www.pingwest.com/why-public-cloud-is-so-difficult-to-... That's why most western companies don't have VPS, IDC or CDN in China.
  - oisino 14y ago
    Great article.. Setting up CDNs in China is extremely hard without government support and local business being lead investors.

51 points by iProject 14y ago

This seems to assume that the certificate chain in the software available within China is not compromised (aka, "obvious" way to detect MITM). I honestly don't know if this is a fair assumption or not, it just strikes me as weird that it is not mentioned when first mentioning the "great firewall"

stock_toaster 14y ago
I suppose they could be using cert pinning[1]. [1]: http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html
- markild 14y ago
  Absolutely. I wish they would address the topic, though. I interpret this article as if they mean that HTTPS solves all censoring and content sensing issues, regardless.
- StavrosK 14y ago
  You mean Apple? In that case, I don't understand how that would help. The user never sees Apple's certificate, they only see the one presented by the MITM, no?
  - markild 14y ago
    In this case, if understand the concept correctly, it would be iTunes that pins the certificate authority for the iTunes server. One would still be vulnerable of a corrupt CA. The only solution to this would be to issue all certificates from an internal CA and verify this in your application.
    - StavrosK 14y ago
      Or you could just harcode the certificate fingerprint and refuse to accept anything else. It's trivial when you own the client. I'm not sure if this would break when you needed to renew the certificate, but I guess you only update the signature, not the actual public key.
      - sp332 14y ago
        But if China is already MITM, they can modify or replace the binary while you are downloading it.
        StavrosK 14y ago
        Yep. In that case, you don't own the client.
    - phillmv 14y ago
      When you ship your own browser and OS you can prob get away with that.
mtgx 14y ago
Bad news: apparently China does have compromised certificates: http://www.reddit.com/r/darknetplan/comments/156pyf/chinas_root_ca_and_the_security_implications/ http://www.reddit.com/r/darknetplan/comments/156pyf/chinas_r... I wonder if China will ever have a revolution, and if the "winners" will even want to revert to a "normal" Internet. The problem is most Chinese don't even know what that is.
- TazeTSchnitzel 14y ago
  >I wonder if China will ever have a revolution I think, personally, that the Chinese government will just get more democratic over time. It's worth noting that China is certainly moreso now than it was a few decades ago.
  - CapitalistCartr 14y ago
    The People's Republic of China is more liberal now than a few decades ago, but not more democratic. The leaders are still not elected by the people.
- MichaelGG 14y ago
  China has a CA. But so do lots of small Latin American countries. It'd be silly to think that a government the size of China cannot compromise some little country's CA. It'd also be silly to think that they cannot get inside at least one US CA. Comodo has shown that their controls are lacking, and that wasn't even a directly compromised employee. So, China having a CA installed, while not great, certainly isn't giving them control they can't already get. Plus, why would they want to risk their own CA cert doing malicious things, where it'd be directly traceable to them?

seanmcdirmid 14y ago

This assumes that https traffic isn't being attacked by the GFW, which it is. But I don't know, the app store was down for me up until a few days ago, so maybe this is working.

ybaumes 14y ago

I've got a question for security experts. I've always assumed that government should have enough cpu-power to decode a few encrypted emails and some https connection. So why don't China decode https traffics and perform the same filter as for simple tcp connection? And even tough they wouldn't have enough power to do so, why don't they break down the https connection when it is established?

StavrosK 14y ago
> I've always assumed that government should have enough cpu-power to decode a few encrypted emails and some https connection It doesn't (that we know of), that's pretty much the point of encryption. Read the excerpt from Schneier's book, presented here: http://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html http://www.schneier.com/blog/archives/2009/09/the_doghouse_c...
est 14y ago
> why don't they break down the https connection when it is established? Apprently they do. Serveral Google domains port 443 were blocked, e.g. https://accounts.google.com https://accounts.google.com so you can't use anything google related, especially Gmail.
simonh 14y ago
Extremely strong 'military grade' encryption is commonplace nowadays. It doesn't matter whether what yo're encrypting is a casual email or the launch codes for a nuclear weapon, consumer grade encryption such as that in https is fine as long as it's configured and used correctly. The CPU power required to break it is greater than all the CPUs in the world put together running for millions of years. The problem is that if a way can be found to disrupt the configuration, such as by compromising the certificate chain, then decrypting the message becomes trivially easy. So reading such a message is usually either impossible, or simple.
mikeash 14y ago
> And even tough they wouldn't have enough power to do so, why don't they break down the https connection when it is established? You have to understand the purpose of China's Great Firewall. A lot of techies think that it's an attempt at 1984-style total control of information. With this in mind, they see a vessel full of obvious leaks, and can't understand why China does things this way. Blocking any connection you can't spy on is a simple solution to these leaks that any techie could come up with, but China doesn't do it (in general). Why not? It's because the Great Firewall is not intended to be an instrument of total information control. It's intended as an instrument of broad social influence. The Chinese government does not care if you can use ssh or SSL or whatever to bounce through a proxy in the USA to get to an article about the Tiananmen Square massacre. You want to put in effort to seek out that information, go wild. You don't even need to cover your tracks. This information is out there. They can't stop it, and they know it, and they don't even try. The purpose of censorship is to shape conversation, not eliminate information. Anyone with a little determination can bypass the firewall and read about whatever censored stuff they're interested in. But the vast majority of people don't have a little determination for this stuff. They might hit a link or perform a search, but when it fails, they'll just move on. Thus, while they can't, don't, and don't even try to stop people from knowing about these things, they can and successfully do stop people in general from thinking about them, and guide their attention to other topics. China doesn't care about a few people using crypto to bypass their censorship. China does care about attracting foreign business, and if travelers couldn't connect to their VPNs and secure web sites then there would be serious trouble with that.

so898 14y ago

According to my friend in China, the App Store is still too slow for him to update his applications. Apple really should build some CDNs in mainland China.

est 14y ago
Someone must translate this. Why public cloud is so difficult to build in China http://www.pingwest.com/why-public-cloud-is-so-difficult-to-build-in-china/ http://www.pingwest.com/why-public-cloud-is-so-difficult-to-... That's why most western companies don't have VPS, IDC or CDN in China.
- oisino 14y ago
  Great article.. Setting up CDNs in China is extremely hard without government support and local business being lead investors.