3 ms·

I am detecting a distinct lack of outrage in this thread. I always thought SSL was largely impervious to MITM attacks due to the third-party CA - in order to g

by smegel 14y ago

I am detecting a distinct lack of outrage in this thread. I always thought SSL was largely impervious to MITM attacks due to the third-party CA - in order to get around that, an attacker would need to intercept DNS requests to the CA - or even intercept IP traffic - and then pretenting to be the CA, return a forged SSL certificate. In addition to decrypting the SSL protocol by sniffing key exchanges. Such a deliberate undermining of a secure protocol, especially the bit where they impersonate an authentication service, seems to cross some boundary of reasonable, or certainly legal, behaviour. Surely a point is reached where it is no longer acceptable to say "our intentions were benign". What am I missing here? Where are the torches and pitchforks?

zokier 14y ago
> What am I missing here? Where are the torches and pitchforks? You are missing the fact that S40 "web browser" is not a web browser in the traditional sense, and plenty of HN readers know that. Imagine that Nokia were running a VNC server with Firefox on it, and the S40 "web browser" were a VNC client connecting to that server. It's pretty obvious that Nokia would be "MITMing" your HTTPS connections in that case. This case is almost the same, but instead of VNC and Firefox they just have some proprietary stack. edit: btw your idea of how SSL works is not entirely correct: > in order to get around that, an attacker would need to intercept DNS requests to the CA - or even intercept IP traffic - and then pretenting to be the CA, return a forged SSL certificate SSL clients to not connect to the CA usually, because it is not necessary to verify the validity of a certificate (due some neat crypto magic). And thus attackers won't intercept requests to CA (because there won't be such requests).
- smegel 14y ago
  > it is evident that Nokia is performing Man In The Middle Attack for sensitive HTTPS traffic originated from their phone I took this statement at face value, and interpreted it to mean that Nokia was "MITMing" end-to-end SSL connections from the phone to the endpoint. If I understand you correctly, and using the VNC analogy, in actual fact the SSL connection is being initiated on a Nokia server by a browser I am running remotely via my phone. And while Nokia does in fact see the decrypted data coming out of the SSL pipe on their server, before they send it to the phone, this would always be an obvious consequence of running a browser to a SSL website via a VNC connection. So the above claim is either a falsehood or at best misleading. Torch extinguished (for now). > btw your idea of how SSL works is not entirely correct I certainly don't claim to have any expertise in SSL, but this did surprise me somewhat. I assumed that when Chrome tells me that "The identity of this website has been verified..." that it had in fact contacted a CA and validated the cert. I might have to read up on this a bit more.

by smegel 14y ago

zokier 14y ago

> What am I missing here? Where are the torches and pitchforks? You are missing the fact that S40 "web browser" is not a web browser in the traditional sense, and plenty of HN readers know that. Imagine that Nokia were running a VNC server with Firefox on it, and the S40 "web browser" were a VNC client connecting to that server. It's pretty obvious that Nokia would be "MITMing" your HTTPS connections in that case. This case is almost the same, but instead of VNC and Firefox they just have some proprietary stack. edit: btw your idea of how SSL works is not entirely correct: > in order to get around that, an attacker would need to intercept DNS requests to the CA - or even intercept IP traffic - and then pretenting to be the CA, return a forged SSL certificate SSL clients to not connect to the CA usually, because it is not necessary to verify the validity of a certificate (due some neat crypto magic). And thus attackers won't intercept requests to CA (because there won't be such requests).

smegel 14y ago
> it is evident that Nokia is performing Man In The Middle Attack for sensitive HTTPS traffic originated from their phone I took this statement at face value, and interpreted it to mean that Nokia was "MITMing" end-to-end SSL connections from the phone to the endpoint. If I understand you correctly, and using the VNC analogy, in actual fact the SSL connection is being initiated on a Nokia server by a browser I am running remotely via my phone. And while Nokia does in fact see the decrypted data coming out of the SSL pipe on their server, before they send it to the phone, this would always be an obvious consequence of running a browser to a SSL website via a VNC connection. So the above claim is either a falsehood or at best misleading. Torch extinguished (for now). > btw your idea of how SSL works is not entirely correct I certainly don't claim to have any expertise in SSL, but this did surprise me somewhat. I assumed that when Chrome tells me that "The identity of this website has been verified..." that it had in fact contacted a CA and validated the cert. I might have to read up on this a bit more.