4 ms·

Surely this is a giant target painted on Nokia's proxy servers for any blackhat out there who wants to intercept a whole lot of https traffic? Seems like a horr

by zmmmmm 14y ago

Surely this is a giant target painted on Nokia's proxy servers for any blackhat out there who wants to intercept a whole lot of https traffic? Seems like a horrible security incident just waiting to happen.

elemeno 14y ago
No more so than any other proxy server.
- wlesieutre 14y ago
  Can a normal proxy server decrypt your HTTPS even it if wants to? I'm by no means an expect on cryptography, but I assume they're only able to do this because they can include their keys on Nokia devices and tell them to trust it. When I access a proxy on my computer, it can't do that. If an arbitrary proxy could MITM a secure connection, HTTPS would be useless.
  - Mandatum 14y ago
    The proxy server could theoretically do that. Whoever has access to your connection is able to.
  - jarrett 14y ago
    No, an ordinary proxy cannot do that. HTTPS is supposed to be end-to-end. I.e. the communications can only be decrypted by the two endpoints. One of the main reasons for signed SSL certificates is to prevent a middleman from masquerading as the endpoint and convincing your browser to negotiate encryption with the middleman rather than the real endpoint. So I presume the Nokia browser is complicit in this scheme.
    - gcb0 14y ago
      In the end, you have to trust the browser. google chrome sends all my pages to translation and what-not. I have to completely trust it. that's why i never use the compiled version but the chromium one only (hence not having access to any addon via the addon site, have to do some manual work there) Even besides the browser, how many computers don't I see the skype button next to phone numbers? would you trust skype is behaving and not sending your data to their servers? did you remember to disable this add-on for ssl pages?
      - ferongr 14y ago
        You're conflating different issues. A browser based on an open-source codebase with many people auditing its source-code and network traffic (there was much paranoia about Chrome when it was released). And even in that case, you have the choice to use a completely open-source browser that has a different stance on user privacy (Firefox). An NPAPI plugin that can be easily disabled. A third-party BOX MITM all your secure connections without your knowledge. I don't think the above are comparable in magnitude.
        jarrett 14y ago
        You're right--the third is the worst by far. And this proves that you can't trust a pre-installed, commercial browser until it has been thoroughly audited by independent researchers.
  - bonaldi 14y ago
    If the proxy also gives you certs to trust it can. Many corporate proxies do this (silently, as they control the PCs) and I've seen more than one academic campus where to access the wifi you have to accept a certificate. On iOS this comes up after connecting to wifi as a reassuring, secure-seeming, official-looking page that pops up inviting you to accept the new certificate. Do so and boom, you're vulnerable to a MITM.
  - tellarin 14y ago
    They don't decrypt HTTPS. The NokiaBrowser (former OviBrowser) is a "proxy browser", a different application that talks to Nokia servers and these servers than establish a regular HTTPS connection. The same as Opera Mini. There is one more layer of abstraction. Do you trust your phone operating system? How do you know it is not capturing your data when you access a bank website? Same issue here. The one difference is that the Nokia servers might be a bigger target for hacking, instead of hacking individual phones.
- InclinedPlane 14y ago
  Unless you control the CA certs installed in the browser, which nokia does, you can't generally decrypt https connections, which is the issue here. It's a man-in-the-middle attack but it's being used "for your own good".
tveita 14y ago
Sounds like a lot of work just to listen to random web traffic. Why not break into Facebook or Gmail instead? Then you could spy on anyone you wanted.
- millerc 14y ago
  Surely this is a giant target painted on Facebook or Gmail's servers for any blackhat out there who wants to intercept a whole lot of traffic.
  - simonh 14y ago
    Facebook and Gmail don't handle your connection to your bank. Apart from that, we already know the Chinese have hacked GMail accounts on several occasions, so Google is already a definite target and the Incidents that have been reported may be just the tip of the iceberg so far as we know. We also know that there have been cases of corporate and government espionage in the recent past. This is happening, right now, and we may never know how extensive it is. It's entirely possible that Nokia could become a target of either technical or even employee infiltration. If so, covert access to a service like this would be a fantastic coup, especially since Nokia phones are still popular in many parts of the world with unscrupulous and technicaly sophisticated governments.
    - millerc 14y ago
      Despite the irony, I'm not arguing it should be less of a concern. Recent mishandling of user accounts by Sony Entertainment and LinkedIn gave us a glimpse of how much damage an intrusion can cause, even though (?) their management thought their intended purpose couldn't lead to any serious liability (speaking through my hat here).
  - ori_b 14y ago
    Of course it is. But that's beside the point. The fewer servers that I interact with that have giant targets and potential security holes the better.
- zmmmmm 14y ago

by zmmmmm 14y ago

elemeno 14y ago

No more so than any other proxy server.

wlesieutre 14y ago
Can a normal proxy server decrypt your HTTPS even it if wants to? I'm by no means an expect on cryptography, but I assume they're only able to do this because they can include their keys on Nokia devices and tell them to trust it. When I access a proxy on my computer, it can't do that. If an arbitrary proxy could MITM a secure connection, HTTPS would be useless.
- Mandatum 14y ago
  The proxy server could theoretically do that. Whoever has access to your connection is able to.
- jarrett 14y ago
  No, an ordinary proxy cannot do that. HTTPS is supposed to be end-to-end. I.e. the communications can only be decrypted by the two endpoints. One of the main reasons for signed SSL certificates is to prevent a middleman from masquerading as the endpoint and convincing your browser to negotiate encryption with the middleman rather than the real endpoint. So I presume the Nokia browser is complicit in this scheme.
  - gcb0 14y ago
    In the end, you have to trust the browser. google chrome sends all my pages to translation and what-not. I have to completely trust it. that's why i never use the compiled version but the chromium one only (hence not having access to any addon via the addon site, have to do some manual work there) Even besides the browser, how many computers don't I see the skype button next to phone numbers? would you trust skype is behaving and not sending your data to their servers? did you remember to disable this add-on for ssl pages?
    - ferongr 14y ago
      You're conflating different issues. A browser based on an open-source codebase with many people auditing its source-code and network traffic (there was much paranoia about Chrome when it was released). And even in that case, you have the choice to use a completely open-source browser that has a different stance on user privacy (Firefox). An NPAPI plugin that can be easily disabled. A third-party BOX MITM all your secure connections without your knowledge. I don't think the above are comparable in magnitude.
      - jarrett 14y ago
        You're right--the third is the worst by far. And this proves that you can't trust a pre-installed, commercial browser until it has been thoroughly audited by independent researchers.
- bonaldi 14y ago
  If the proxy also gives you certs to trust it can. Many corporate proxies do this (silently, as they control the PCs) and I've seen more than one academic campus where to access the wifi you have to accept a certificate. On iOS this comes up after connecting to wifi as a reassuring, secure-seeming, official-looking page that pops up inviting you to accept the new certificate. Do so and boom, you're vulnerable to a MITM.
- tellarin 14y ago
  They don't decrypt HTTPS. The NokiaBrowser (former OviBrowser) is a "proxy browser", a different application that talks to Nokia servers and these servers than establish a regular HTTPS connection. The same as Opera Mini. There is one more layer of abstraction. Do you trust your phone operating system? How do you know it is not capturing your data when you access a bank website? Same issue here. The one difference is that the Nokia servers might be a bigger target for hacking, instead of hacking individual phones.
InclinedPlane 14y ago
Unless you control the CA certs installed in the browser, which nokia does, you can't generally decrypt https connections, which is the issue here. It's a man-in-the-middle attack but it's being used "for your own good".

tveita 14y ago

Sounds like a lot of work just to listen to random web traffic. Why not break into Facebook or Gmail instead? Then you could spy on anyone you wanted.

millerc 14y ago
Surely this is a giant target painted on Facebook or Gmail's servers for any blackhat out there who wants to intercept a whole lot of traffic.
- simonh 14y ago
  Facebook and Gmail don't handle your connection to your bank. Apart from that, we already know the Chinese have hacked GMail accounts on several occasions, so Google is already a definite target and the Incidents that have been reported may be just the tip of the iceberg so far as we know. We also know that there have been cases of corporate and government espionage in the recent past. This is happening, right now, and we may never know how extensive it is. It's entirely possible that Nokia could become a target of either technical or even employee infiltration. If so, covert access to a service like this would be a fantastic coup, especially since Nokia phones are still popular in many parts of the world with unscrupulous and technicaly sophisticated governments.
  - millerc 14y ago
    Despite the irony, I'm not arguing it should be less of a concern. Recent mishandling of user accounts by Sony Entertainment and LinkedIn gave us a glimpse of how much damage an intrusion can cause, even though (?) their management thought their intended purpose couldn't lead to any serious liability (speaking through my hat here).
- ori_b 14y ago
  Of course it is. But that's beside the point. The fewer servers that I interact with that have giant targets and potential security holes the better.
zmmmmm 14y ago