5 ms·

The Nokia Xpress Browser is not an HTTP web browser. It is a specialized client that talks to transcoding servers. It is designed for low-end phones in emerging

The Nokia Xpress Browser is not an HTTP web browser. It is a specialized client that talks to transcoding servers. It is designed for low-end phones in emerging markets. These phones have 128MB of RAM or less, they are not capable of running full web browsers. If a user has a phone capable of running a full browser (like the Lumia phones) and they choose to install the Nokia browser or Opera Mini to save on data usage, they are opting-in for the service. The compressing browser is not the default browser for Nokia phone running Windows Phone 7/8, MeeGo, Symbian^3, or S60. http://www.developer.nokia.com/Community/Wiki/User-Agent_headers_for_Nokia_devices http://www.developer.nokia.com/Community/Wiki/User-Agent_hea... There is no MITM attack. They are not spoofing DNS or forging SSL certs. They are providing a service that users are opting in to use. If you don't trust Nokia, don't use their phones. Even with end-to-end encryption, the data (including voice calls) is unencrypted on your phone until the software and hardware encrypts it. The maker of the software and hardware always has the capability to add eavesdropping code if they want.

benatkin 14y ago
Wrong. It is an MITM issue. GMail and Twitter are free to offer non-SSL service but they choose not to. Also I'm very doubtful about the economics of offering a phone with a weak CPU and memory configuration. Aren't screens a big chunk of the price?
- magic_haze 14y ago
  I don't think the issue is quite as black-and-white: does the physical location where a computation is performed really of any importance in this case?, You don't have control over what's going on in the hardware anyway. I'm not condoning Nokia, but I really don't see any difference here.
- antoncohen 14y ago
  If I use Thunderbird to send an email to foo@example.com, via Gmail, submitted with TLS encrypted SMTP on port 587, and Google decrypts my transmission and forwards it to mail.example.com unencrypted, is Google performing a MITM attack on my communication with example.com? No, they are providing the service I requested. The Nokia browser is essentially a thin client that communicates with a remotely hosted web browser. The remote web browser, running on Nokia's servers, does all the complicated JavaScript and advanced CSS stuff, and converts it to a dumbed down version that can be displayed on the phone. There clearly is a cost savings in using low-end parts. Not all screens are created equal, for example the Nokia Asha 306 uses a 240x400px resistive touchscreen. If you have ever used a phone with a resistive touchscreen you know how bad they are. It also has 32MB of RAM, 10MB of user storage, 2G data (not 3G), and no GPS. You can't run a WebKit + V8 browser on a phone with those specs, you just can't. The BOM for a Nokia Lumia 900 (high end, with a 480x800px capacitive touchscreen) is here: http://www.isuppli.com/Teardowns/News/Pages/Nokia-900-Carries-Bill-of-Materials-of-$209.aspx http://www.isuppli.com/Teardowns/News/Pages/Nokia-900-Carrie...
  - bad_user 14y ago
    In your example the certificate you're being given when connecting through SMTP is for smtp.gmail.com. It is this certificate that proves your connection is to smtp.gmail.com and not somebody else. That's the whole freaking point of HTTPS. What Google does from there, it's their business, but NO, they are not the man in the middle, as you explicitly and willfully connected to them and allowed them to send email on your behalf. On the other hand, connecting to HTTPS with one of these Nokia phones leaves you with the impression that HTTPS connections to google.com are secure, when in fact the Nokia device is LYING TO YOU. The example you've given couldn't have been any worst.
    - antoncohen 14y ago
      Nokia is not faking certs. The "browser" only talks to .browser.ovi.com and the SSL certs are issued to .browser.ovi.com. SSL is working exactly as they should. The "security researcher" didn't understand the results he was seeing and freaked out. The Nokia phone only does a DNS lookup of .browser.ovi.com, it only connects to .browser.ovi.com, and it only gets an SSL cert from .browser.ovi.com. Here is post from the "security researcher", so you can see who the certs are issued to: http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/ http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/
      - deleted 14y ago
        [deleted]
      - benatkin 14y ago
        Except GMail and Twitter's intent in offering SSL is not to offer it to .browser.ovi.com but to offer it to users' devices.
Nikker 14y ago
An interesting question, if Nokia informed their customers before the purchase would they have still bought the hardware? It's not really quite as altruistic of Nokia they don't put the cards firmly on the table before hand.
- mcovey 14y ago
  Do they have to educate their customers as to the meaning of terms like "SSL" and "encryption" as well? Otherwise many won't know what to make of it.
  - r00fus 14y ago
    Simple analogy: Dealer wants to sell you a car, but requires installation of an internal monitoring camera.
    - slavak 14y ago
      How is this in any way analogous to the Nokia situation? Nokia aren't passing traffic through their proxy because they want access to your data, they're doing it because your device isn't powerful enough to perform the necessary computations itself. It's a privacy concern as it is. Please don't muddy the waters by spreading FUD and conflating this with something it's not.
      - Nikker 14y ago
        Lets say I run a mail forwarding service. I get your permission to go to each of your mail boxes and send your mail to where ever you happen to be. Mail is heavy though and to save you money I open all your mail remove a couple of pages / brochures / ads, reseal it in the original envelope and don't tell you. I promise I don't read your mail when I get caught. I'm giving the first 3 months free, please provide your information below so I can get started today!
      - chris_wot 14y ago
        Dealer wants to sell you a car, but installs an internal monitoring camera to do maintenance in order to see the condition of the roads you drive on. But doesn't tell you.
zurn 14y ago
> If you don't trust Nokia, don't use their phones. There's a rather big difference in trusting their phones vs. trusting their services in this case: Mobile network vendors (including Nokia's NSN) have a record of being very very helpful in supporting government wiretapping. see eg http://www.washingtontimes.com/news/2009/apr/13/europe39s-telecoms-aid-with-spy-tech/ http://www.washingtontimes.com/news/2009/apr/13/europe39s-te... This is a much bigger problem in China, etc (the "emerging markets" under discussion) than in the west. It's much less likely they've built backdoors into the handset, and if they do they risk getting caught. > They are providing a service that users are opting in to use. No, there's no opting in to the violation of end-to-end security here.
- antoncohen 14y ago
  The funny thing is, Nokia's Xpress Browser did the opposite (for a day), allowing people in China to browse any site on the internet. It worked like a secure proxy or VPN, punching a hole through the Great Firewall. Until China caught on and blocked the IP addresses of Nokia servers. http://www.wpcentral.com/nokias-xpress-browser-has-been-blocked-chinas-great-firewall http://www.wpcentral.com/nokias-xpress-browser-has-been-bloc...
- s_husso 14y ago
  > Mobile network vendors (including Nokia's NSN) have a record of being very very helpful in supporting government wiretapping. I think the major issue is that you cannot 'sell' any core mobile network-devices without: http://en.wikipedia.org/wiki/Lawful_interception http://en.wikipedia.org/wiki/Lawful_interception So "very helpful" is kinda debatable in my opinion.
  - potkor 14y ago
    If you read the linked Washington Times article, the "monitoring centers" sound like separatete bells-and-whistles products that are not the same as the mandated LI mechanisms. Lots of other vendors market these government espionage tools to autocratic regimes too. Eg Bluecoat, Cisco etc. At any rate it feels bad that we have to appeal to these human rights abusing autocracies, it's not any better to have these mechanisms built into the western networks.
leoh 14y ago
I'm sort of confused as how this works. If it is not a MITM attack (i.e. using false SSL certificates), then how is Nokia readily decrypting data? I thought SSL was relatively non-trivial to crack.
- crdoconnor 14y ago
  Your phone is basically just remotely using a browser on Nokia's servers. Their servers are the ones actually initiating the SSL connection.
  - leoh 14y ago
    Got it. I think the title of the article is misleading when it says they decrypt the data. It's true of course, since they hold the client certificate. I hope data is ferried to their server in an encrypted format at least.
- antoncohen 14y ago
  It's not a web browser in the way you are thinking of. It's a client for a Nokia service. The client does not attempt to connect to a website, instead it asks the Nokia service to render a website and provide a rendered version. These phones are too under-powered to render modern web pages. It's either this or they have to view only WAP pages. If you have never used WAP on an old phone, go login to Yahoo Mail at http://wap.yahoo.com/ http://wap.yahoo.com/
- rplnt 14y ago
  http://www.opera.com/mobile/specs/ http://www.opera.com/mobile/specs/ Opera Mini in that picture is basically the same as the Nokia browser. You are not client, you just control remote client that will communicate with web server, retrieve data, process them and display them to you. Overly complicated comparison would be you controlling browser on a remote desktop. Nothing has to be cracked, yet you can see data on your computer while the other computer can see them too.
nodata 14y ago
The expectation of using an SSL connection is that there will be end to end encryption. This is not the case here, and the user should be informed and given the chance to opt-in.
- chii 14y ago
  except most people don't know what SSL is, and how it applies - other than that padlock. IN this case, the padlock doesn't prevent nokia from eavesdropping on you. But when asked, a non-technical customer wouldnt know or understand this, and thus opt in, where as if they did understand it they won't opt in.
  - nodata 14y ago
    But we are the technical users. And we just found out a bad thing, that affects non-technical users. It's our responsibility to highlight this.
andyking 14y ago
There is no browser for the Lumia phones other than Internet Explorer - they don't allow alternative browsers in the WP marketplace.
- gjulianm 14y ago
  Yes, they allow alternative browsers. I've seen web browsers on the marketplace (SurfCube, for example) completely functional. What I'm not so sure is if they allow browsers using other rendering engines than Trident (i.e., they don't use the native WebBrowser control).
  - Aissen 14y ago
    These are not alternative browsers. They are alternative UIs to the same browser engine (sometimes with a worse JS engine…). Just like Chrome on iOS.
- antoncohen 14y ago
  Nokia Xpress is available for Lumia[1]. Just like Apple doesn't allow alternate browser engines on iOS, but it allows Opera Mini[2] because Opera Mini isn't a full web browser, it's a client for Opera's transcoding service. Nokia Xpress isn't a full web browser, it doesn't execute JavaScript, it is a client to Nokia's transcoding service. [1] http://betalabs.nokia.com/trials/nokia-xpress-internet http://betalabs.nokia.com/trials/nokia-xpress-internet [2] https://itunes.apple.com/us/app/opera-mini-web-browser/id363729560 https://itunes.apple.com/us/app/opera-mini-web-browser/id363...
darkarmani 14y ago
> The Nokia Xpress Browser is not an HTTP web browser. And yet there is confusion around it. The onus is on Nokia to educate their users that it isn't as secure as a HTTPS web browser.
EugeneOZ 14y ago
>If you don't trust Nokia, don't use their phones. You are right. And now I don't trust Nokia, after reading this news.
tripzilch 14y ago
> If you don't trust Nokia, don't use their phones Well duh. Remember how a while ago Nokia got a bit of bad press about developing the DPI technology for Iran and Egypt? (together in a joint venture with Siemens). So they made a press release[1] about how it has come to their attention that this technology was being used for human-rights abuse (GASP you don't say?). As a result they "halted all work at monitoring centres" and promised they wouldn't do it again. And now there is this. It is not quite as severe, but it's the very same careless attitude regarding people's privacy in contexts were this privacy really really should be maintained. It seems pretty obvious they do not care, each time until they're caught red-handed. So IMO, you can leave the "if" out of that statement and shorten it to "don't trust Nokia". Shame on Opera for being part of this, too. > The maker of the software and hardware always has the capability to add eavesdropping code if they want. Well that's the point, isn't it? You always need to trust your hardware manufacturer that they won't do this. Developing DPI technology for oppressive regimes does not quite engender this type of trust. Nokia has to do a little bit more than just a press release before they earn that basic level of trust again (if ever). [0] http://www.nokiasiemensnetworks.com/news-events/press-room/clarification-on-nokia-siemens-networks-business-in-iran http://www.nokiasiemensnetworks.com/news-events/press-room/c... [1] http://www.nokiasiemensnetworks.com/news-events/press-room/statements/telecoms-and-human-rights http://www.nokiasiemensnetworks.com/news-events/press-room/s...

benatkin 14y ago

Wrong. It is an MITM issue. GMail and Twitter are free to offer non-SSL service but they choose not to. Also I'm very doubtful about the economics of offering a phone with a weak CPU and memory configuration. Aren't screens a big chunk of the price?

magic_haze 14y ago
I don't think the issue is quite as black-and-white: does the physical location where a computation is performed really of any importance in this case?, You don't have control over what's going on in the hardware anyway. I'm not condoning Nokia, but I really don't see any difference here.
antoncohen 14y ago
If I use Thunderbird to send an email to foo@example.com, via Gmail, submitted with TLS encrypted SMTP on port 587, and Google decrypts my transmission and forwards it to mail.example.com unencrypted, is Google performing a MITM attack on my communication with example.com? No, they are providing the service I requested. The Nokia browser is essentially a thin client that communicates with a remotely hosted web browser. The remote web browser, running on Nokia's servers, does all the complicated JavaScript and advanced CSS stuff, and converts it to a dumbed down version that can be displayed on the phone. There clearly is a cost savings in using low-end parts. Not all screens are created equal, for example the Nokia Asha 306 uses a 240x400px resistive touchscreen. If you have ever used a phone with a resistive touchscreen you know how bad they are. It also has 32MB of RAM, 10MB of user storage, 2G data (not 3G), and no GPS. You can't run a WebKit + V8 browser on a phone with those specs, you just can't. The BOM for a Nokia Lumia 900 (high end, with a 480x800px capacitive touchscreen) is here: http://www.isuppli.com/Teardowns/News/Pages/Nokia-900-Carries-Bill-of-Materials-of-$209.aspx http://www.isuppli.com/Teardowns/News/Pages/Nokia-900-Carrie...
- bad_user 14y ago
  In your example the certificate you're being given when connecting through SMTP is for smtp.gmail.com. It is this certificate that proves your connection is to smtp.gmail.com and not somebody else. That's the whole freaking point of HTTPS. What Google does from there, it's their business, but NO, they are not the man in the middle, as you explicitly and willfully connected to them and allowed them to send email on your behalf. On the other hand, connecting to HTTPS with one of these Nokia phones leaves you with the impression that HTTPS connections to google.com are secure, when in fact the Nokia device is LYING TO YOU. The example you've given couldn't have been any worst.
  - antoncohen 14y ago
    Nokia is not faking certs. The "browser" only talks to .browser.ovi.com and the SSL certs are issued to .browser.ovi.com. SSL is working exactly as they should. The "security researcher" didn't understand the results he was seeing and freaked out. The Nokia phone only does a DNS lookup of .browser.ovi.com, it only connects to .browser.ovi.com, and it only gets an SSL cert from .browser.ovi.com. Here is post from the "security researcher", so you can see who the certs are issued to: http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/ http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/
    - deleted 14y ago
      [deleted]
    - benatkin 14y ago
      Except GMail and Twitter's intent in offering SSL is not to offer it to .browser.ovi.com but to offer it to users' devices.

Nikker 14y ago

An interesting question, if Nokia informed their customers before the purchase would they have still bought the hardware? It's not really quite as altruistic of Nokia they don't put the cards firmly on the table before hand.

mcovey 14y ago
Do they have to educate their customers as to the meaning of terms like "SSL" and "encryption" as well? Otherwise many won't know what to make of it.
- r00fus 14y ago
  Simple analogy: Dealer wants to sell you a car, but requires installation of an internal monitoring camera.
  - slavak 14y ago
    How is this in any way analogous to the Nokia situation? Nokia aren't passing traffic through their proxy because they want access to your data, they're doing it because your device isn't powerful enough to perform the necessary computations itself. It's a privacy concern as it is. Please don't muddy the waters by spreading FUD and conflating this with something it's not.
    - Nikker 14y ago
      Lets say I run a mail forwarding service. I get your permission to go to each of your mail boxes and send your mail to where ever you happen to be. Mail is heavy though and to save you money I open all your mail remove a couple of pages / brochures / ads, reseal it in the original envelope and don't tell you. I promise I don't read your mail when I get caught. I'm giving the first 3 months free, please provide your information below so I can get started today!
    - chris_wot 14y ago
      Dealer wants to sell you a car, but installs an internal monitoring camera to do maintenance in order to see the condition of the roads you drive on. But doesn't tell you.

zurn 14y ago

> If you don't trust Nokia, don't use their phones. There's a rather big difference in trusting their phones vs. trusting their services in this case: Mobile network vendors (including Nokia's NSN) have a record of being very very helpful in supporting government wiretapping. see eg http://www.washingtontimes.com/news/2009/apr/13/europe39s-telecoms-aid-with-spy-tech/ http://www.washingtontimes.com/news/2009/apr/13/europe39s-te... This is a much bigger problem in China, etc (the "emerging markets" under discussion) than in the west. It's much less likely they've built backdoors into the handset, and if they do they risk getting caught. > They are providing a service that users are opting in to use. No, there's no opting in to the violation of end-to-end security here.

antoncohen 14y ago
The funny thing is, Nokia's Xpress Browser did the opposite (for a day), allowing people in China to browse any site on the internet. It worked like a secure proxy or VPN, punching a hole through the Great Firewall. Until China caught on and blocked the IP addresses of Nokia servers. http://www.wpcentral.com/nokias-xpress-browser-has-been-blocked-chinas-great-firewall http://www.wpcentral.com/nokias-xpress-browser-has-been-bloc...
s_husso 14y ago
> Mobile network vendors (including Nokia's NSN) have a record of being very very helpful in supporting government wiretapping. I think the major issue is that you cannot 'sell' any core mobile network-devices without: http://en.wikipedia.org/wiki/Lawful_interception http://en.wikipedia.org/wiki/Lawful_interception So "very helpful" is kinda debatable in my opinion.
- potkor 14y ago
  If you read the linked Washington Times article, the "monitoring centers" sound like separatete bells-and-whistles products that are not the same as the mandated LI mechanisms. Lots of other vendors market these government espionage tools to autocratic regimes too. Eg Bluecoat, Cisco etc. At any rate it feels bad that we have to appeal to these human rights abusing autocracies, it's not any better to have these mechanisms built into the western networks.

leoh 14y ago

I'm sort of confused as how this works. If it is not a MITM attack (i.e. using false SSL certificates), then how is Nokia readily decrypting data? I thought SSL was relatively non-trivial to crack.

crdoconnor 14y ago
Your phone is basically just remotely using a browser on Nokia's servers. Their servers are the ones actually initiating the SSL connection.
- leoh 14y ago
  Got it. I think the title of the article is misleading when it says they decrypt the data. It's true of course, since they hold the client certificate. I hope data is ferried to their server in an encrypted format at least.
antoncohen 14y ago
It's not a web browser in the way you are thinking of. It's a client for a Nokia service. The client does not attempt to connect to a website, instead it asks the Nokia service to render a website and provide a rendered version. These phones are too under-powered to render modern web pages. It's either this or they have to view only WAP pages. If you have never used WAP on an old phone, go login to Yahoo Mail at http://wap.yahoo.com/ http://wap.yahoo.com/
rplnt 14y ago
http://www.opera.com/mobile/specs/ http://www.opera.com/mobile/specs/ Opera Mini in that picture is basically the same as the Nokia browser. You are not client, you just control remote client that will communicate with web server, retrieve data, process them and display them to you. Overly complicated comparison would be you controlling browser on a remote desktop. Nothing has to be cracked, yet you can see data on your computer while the other computer can see them too.

nodata 14y ago

The expectation of using an SSL connection is that there will be end to end encryption. This is not the case here, and the user should be informed and given the chance to opt-in.

chii 14y ago
except most people don't know what SSL is, and how it applies - other than that padlock. IN this case, the padlock doesn't prevent nokia from eavesdropping on you. But when asked, a non-technical customer wouldnt know or understand this, and thus opt in, where as if they did understand it they won't opt in.
- nodata 14y ago
  But we are the technical users. And we just found out a bad thing, that affects non-technical users. It's our responsibility to highlight this.

andyking 14y ago

There is no browser for the Lumia phones other than Internet Explorer - they don't allow alternative browsers in the WP marketplace.

gjulianm 14y ago
Yes, they allow alternative browsers. I've seen web browsers on the marketplace (SurfCube, for example) completely functional. What I'm not so sure is if they allow browsers using other rendering engines than Trident (i.e., they don't use the native WebBrowser control).
- Aissen 14y ago
  These are not alternative browsers. They are alternative UIs to the same browser engine (sometimes with a worse JS engine…). Just like Chrome on iOS.
antoncohen 14y ago
Nokia Xpress is available for Lumia[1]. Just like Apple doesn't allow alternate browser engines on iOS, but it allows Opera Mini[2] because Opera Mini isn't a full web browser, it's a client for Opera's transcoding service. Nokia Xpress isn't a full web browser, it doesn't execute JavaScript, it is a client to Nokia's transcoding service. [1] http://betalabs.nokia.com/trials/nokia-xpress-internet http://betalabs.nokia.com/trials/nokia-xpress-internet [2] https://itunes.apple.com/us/app/opera-mini-web-browser/id363729560 https://itunes.apple.com/us/app/opera-mini-web-browser/id363...

darkarmani 14y ago

> The Nokia Xpress Browser is not an HTTP web browser. And yet there is confusion around it. The onus is on Nokia to educate their users that it isn't as secure as a HTTPS web browser.

EugeneOZ 14y ago

>If you don't trust Nokia, don't use their phones. You are right. And now I don't trust Nokia, after reading this news.

tripzilch 14y ago

> If you don't trust Nokia, don't use their phones Well duh. Remember how a while ago Nokia got a bit of bad press about developing the DPI technology for Iran and Egypt? (together in a joint venture with Siemens). So they made a press release[1] about how it has come to their attention that this technology was being used for human-rights abuse (GASP you don't say?). As a result they "halted all work at monitoring centres" and promised they wouldn't do it again. And now there is this. It is not quite as severe, but it's the very same careless attitude regarding people's privacy in contexts were this privacy really really should be maintained. It seems pretty obvious they do not care, each time until they're caught red-handed. So IMO, you can leave the "if" out of that statement and shorten it to "don't trust Nokia". Shame on Opera for being part of this, too. > The maker of the software and hardware always has the capability to add eavesdropping code if they want. Well that's the point, isn't it? You always need to trust your hardware manufacturer that they won't do this. Developing DPI technology for oppressive regimes does not quite engender this type of trust. Nokia has to do a little bit more than just a press release before they earn that basic level of trust again (if ever). [0] http://www.nokiasiemensnetworks.com/news-events/press-room/clarification-on-nokia-siemens-networks-business-in-iran http://www.nokiasiemensnetworks.com/news-events/press-room/c... [1] http://www.nokiasiemensnetworks.com/news-events/press-room/statements/telecoms-and-human-rights http://www.nokiasiemensnetworks.com/news-events/press-room/s...