6 ms·

> China's surveillance is always so blatant and public, they don't bother trying to hide it like America. I'm a little shocked - they've surely got the ability

> China's surveillance is always so blatant and public, they don't bother trying to hide it like America. I'm a little shocked - they've surely got the ability to do a proper MITM. CNNIC is a root CA for plenty of browsers. Saving it up for when they really need it, maybe?

ryan-c 12y ago
If they got caught it'd get removed from Firefox and Chrome. I am more surprised that they don't have common Chinese software install a set of MitM CAs.
- dmix 12y ago
  > I am more surprised that they don't have common Chinese software install a set of MitM CAs. It said in the article: the most popular Chinese browser Qihoop 360 browser doesn't even giving a warning for the bad SSL cert. "Qihoo’s popular Chinese 360 secure browser is anything but and will load the MITMed page directly." https://en.wikipedia.org/wiki/Qihoo https://en.wikipedia.org/wiki/Qihoo
  - ryan-c 12y ago
    See my other comment. * The popularity of that browser is way over reported - they tend to report "installed" statistics rather than "used". * If you read the article you'll see self signed certificates were used for the MitM. From my own research, 360 secure browser just doesn't validate certificates in many circumstances. No CA required.
    - ttflee 12y ago
      According to my observation Qihoo Browser was more frequently used by a tech noob than tech savvy. And this alone poses great risk of the general public regardless to the underlying ethnics and interests.
- danielweber 12y ago
  How do you know that Firefox and Chrome have not been altered?
  - ikawe 12y ago
    The app code signing process provides some assurance that the app has not been altered. https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html https://developer.apple.com/library/mac/documentation/Securi... edit: but only in so much as you trust Apple, as they provide and verify the keys. But... assuming you're using an iphone, this isn't really a new threat vector.
  - ryan-c 12y ago
    Any software installed on the system can add root CAs to both of them.
    - rictic 12y ago
      This may no longer be true for Chrome at least. They recently added protection against unauthorized configuration changes by third party programs. I'm having trouble determining whether that protection extends to root CAs though.
      - ryan-c 12y ago
        Chrome, last I checked, mostly relies on the OS list of trusted CAs in OS X and Windows, and brings its own on Linux which uses NSS.
TazeTSchnitzel 12y ago
If they abuse CNNIC, they lose CNNIC. So they just get the gullible.
- pyre 12y ago
  They could also do targeted MITM attacks where only one person is served via the forged certificate. That's harder to detect, and if it's all spycraft, then the target on the receiving end is unlikely to report the breach.
  - TazeTSchnitzel 12y ago
    Sure. They'll only use CNNIC in situations where people won't notice.
tonyplee 12y ago
Agree! The real spy agencies can do it smarter - signed with its own root CA, etc. It might also be other 3rd parties who is doing the MITM. Anyone can setup a fake free wifi, reroute the DNS system. Some percentage of those "free" service users will press "OK" to let other sniff their "secure" connections.
cnphil 12y ago
They've got like tons of CAs. In China, it's very common for websites to ask people to trust their self-issued certificates. If you want to buy train tickets in China, you end up with this page (https://kyfw.12306.cn/otn https://kyfw.12306.cn/otn) which asks you to trust its own cert.
- owenmarshall 12y ago
  Ah, so there's an expectation amongst Chinese users that a self-signed cert is sufficient? Well.
  - sillysaurus3 12y ago
    I mean, what would you do? If you want the train ticket, you have to accept those terms. And you need the train ticket.
    - baby 12y ago
      You could go to the train station (I've never bought a train ticket online there).
      - dengnan 12y ago
        Here's some history background of the train in China. (I realized that I have to start from the Hukou policy so that I could tell a reasonable story. Please bear with me.) TL;DR, This is what a train station looks like before Chinese New Year [1]. Let's start from Hukou policy: Every Chinese is required to register their information to the government and has to provide a permanent address. This looks similar to most other country. But it goes quite far beyond a simple registration. Your Hukou is associated with a permanent address and in many cases, you are only allowed to do many critical things within the city of your permanent address. For example, your child cannot go to the local schools outside their Hukou address. Changing your address on Hukou is very hard and usually happens in some cases: When you go to university, you are allowed to temporarily change your Hukou under the university's city; 2. If you found a job in another city and your employer is willing to help you to relocate your Hukou address. 3. You married with a local person for several years. Basically, you can understand Hukou as a domestic visa. There are two types of Hukou: Farmer Hukou and City Hukou. Basically, they have different benefits/restrictions. Similar to F1 visa, H1B visa, etc. Well, why I mention this? Here is some history. 30 years ago, major amount of the Chinese population were farmers. To build cities, you have to let those farmers live in the city and do lots of construction works. Due to the Hukou policy, people are not allowed to permanently migrate, esp. changing their Hukou status from Farmer to City. But there's more opportunities in cities and people could make more money. So gradually, there emerges a large group of people whose Hukou address is out of city but work in the cities. Their family has to in their home town, otherwise their children cannot go to school in the cities. Every year, people works outside their home town will try to go back during Chinese New Year. Since the fact I mentioned above, there's a huge amount of people. They have to take trains (which is cheaper than flight.) Such yearly migration is quite large, ~3.3B tickets in 2014 [0]. Oh, and here is the answer to your question: Go to the train station is really not an option. It's like black Friday, but in a much larger scale. People have to wait outside for even weeks to get a ticket. To some extend, online ticket system helps. However, because of the throughput of the train system is limited, it's still hard to get a ticket. 0. http://en.wikipedia.org/wiki/Chunyun http://en.wikipedia.org/wiki/Chunyun 1. https://www.google.com/search?q=%E6%98%A5%E8%BF%90&espv=2&source=lnms&tbm=isch&sa=X&ei=VEtFVNe_F4SnyQSvkYKIBg&ved=0CAYQ_AUoAQ&biw=1855&bih=993 https://www.google.com/search?q=%E6%98%A5%E8%BF%90&espv=2&so...
DasIch 12y ago
Even a government will only have the capabibilty to perform meaningful surveillance on a limited number of people not to mention act on it. Assuming the majority of people desire not to be tortured or killed far more then they desire freedom. It's probably more effective to simply pretend that you're performing surveillance as an intimidation tactic, than to actually perform surveillance unnoticed. It's also far more socially acceptable on an international level than violence.
- tessierashpool 12y ago
  Agree & disagree. Re this: Even a government will only have the capabibilty to perform meaningful surveillance on a limited number of people not to mention act on it. That claim is currently true, but if you understand Bayes' Theorem and Moore's Law, you know that it's just a matter of time. But re this: It's probably more effective to simply pretend that you're performing surveillance as an intimidation tactic, than to actually perform surveillance unnoticed. iirc, former East German Stasi or KGB have said essentially the same thing.

ryan-c 12y ago

If they got caught it'd get removed from Firefox and Chrome. I am more surprised that they don't have common Chinese software install a set of MitM CAs.

dmix 12y ago
> I am more surprised that they don't have common Chinese software install a set of MitM CAs. It said in the article: the most popular Chinese browser Qihoop 360 browser doesn't even giving a warning for the bad SSL cert. "Qihoo’s popular Chinese 360 secure browser is anything but and will load the MITMed page directly." https://en.wikipedia.org/wiki/Qihoo https://en.wikipedia.org/wiki/Qihoo
- ryan-c 12y ago
  See my other comment. * The popularity of that browser is way over reported - they tend to report "installed" statistics rather than "used". * If you read the article you'll see self signed certificates were used for the MitM. From my own research, 360 secure browser just doesn't validate certificates in many circumstances. No CA required.
  - ttflee 12y ago
    According to my observation Qihoo Browser was more frequently used by a tech noob than tech savvy. And this alone poses great risk of the general public regardless to the underlying ethnics and interests.
danielweber 12y ago
How do you know that Firefox and Chrome have not been altered?
- ikawe 12y ago
  The app code signing process provides some assurance that the app has not been altered. https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html https://developer.apple.com/library/mac/documentation/Securi... edit: but only in so much as you trust Apple, as they provide and verify the keys. But... assuming you're using an iphone, this isn't really a new threat vector.
- ryan-c 12y ago
  Any software installed on the system can add root CAs to both of them.
  - rictic 12y ago
    This may no longer be true for Chrome at least. They recently added protection against unauthorized configuration changes by third party programs. I'm having trouble determining whether that protection extends to root CAs though.
    - ryan-c 12y ago
      Chrome, last I checked, mostly relies on the OS list of trusted CAs in OS X and Windows, and brings its own on Linux which uses NSS.

TazeTSchnitzel 12y ago

If they abuse CNNIC, they lose CNNIC. So they just get the gullible.

pyre 12y ago
They could also do targeted MITM attacks where only one person is served via the forged certificate. That's harder to detect, and if it's all spycraft, then the target on the receiving end is unlikely to report the breach.
- TazeTSchnitzel 12y ago
  Sure. They'll only use CNNIC in situations where people won't notice.

tonyplee 12y ago

Agree! The real spy agencies can do it smarter - signed with its own root CA, etc. It might also be other 3rd parties who is doing the MITM. Anyone can setup a fake free wifi, reroute the DNS system. Some percentage of those "free" service users will press "OK" to let other sniff their "secure" connections.

cnphil 12y ago

They've got like tons of CAs. In China, it's very common for websites to ask people to trust their self-issued certificates. If you want to buy train tickets in China, you end up with this page (https://kyfw.12306.cn/otn https://kyfw.12306.cn/otn) which asks you to trust its own cert.

owenmarshall 12y ago
Ah, so there's an expectation amongst Chinese users that a self-signed cert is sufficient? Well.
- sillysaurus3 12y ago
  I mean, what would you do? If you want the train ticket, you have to accept those terms. And you need the train ticket.
  - baby 12y ago
    You could go to the train station (I've never bought a train ticket online there).
    - dengnan 12y ago
      Here's some history background of the train in China. (I realized that I have to start from the Hukou policy so that I could tell a reasonable story. Please bear with me.) TL;DR, This is what a train station looks like before Chinese New Year [1]. Let's start from Hukou policy: Every Chinese is required to register their information to the government and has to provide a permanent address. This looks similar to most other country. But it goes quite far beyond a simple registration. Your Hukou is associated with a permanent address and in many cases, you are only allowed to do many critical things within the city of your permanent address. For example, your child cannot go to the local schools outside their Hukou address. Changing your address on Hukou is very hard and usually happens in some cases: When you go to university, you are allowed to temporarily change your Hukou under the university's city; 2. If you found a job in another city and your employer is willing to help you to relocate your Hukou address. 3. You married with a local person for several years. Basically, you can understand Hukou as a domestic visa. There are two types of Hukou: Farmer Hukou and City Hukou. Basically, they have different benefits/restrictions. Similar to F1 visa, H1B visa, etc. Well, why I mention this? Here is some history. 30 years ago, major amount of the Chinese population were farmers. To build cities, you have to let those farmers live in the city and do lots of construction works. Due to the Hukou policy, people are not allowed to permanently migrate, esp. changing their Hukou status from Farmer to City. But there's more opportunities in cities and people could make more money. So gradually, there emerges a large group of people whose Hukou address is out of city but work in the cities. Their family has to in their home town, otherwise their children cannot go to school in the cities. Every year, people works outside their home town will try to go back during Chinese New Year. Since the fact I mentioned above, there's a huge amount of people. They have to take trains (which is cheaper than flight.) Such yearly migration is quite large, ~3.3B tickets in 2014 [0]. Oh, and here is the answer to your question: Go to the train station is really not an option. It's like black Friday, but in a much larger scale. People have to wait outside for even weeks to get a ticket. To some extend, online ticket system helps. However, because of the throughput of the train system is limited, it's still hard to get a ticket. 0. http://en.wikipedia.org/wiki/Chunyun http://en.wikipedia.org/wiki/Chunyun 1. https://www.google.com/search?q=%E6%98%A5%E8%BF%90&espv=2&source=lnms&tbm=isch&sa=X&ei=VEtFVNe_F4SnyQSvkYKIBg&ved=0CAYQ_AUoAQ&biw=1855&bih=993 https://www.google.com/search?q=%E6%98%A5%E8%BF%90&espv=2&so...

DasIch 12y ago

Even a government will only have the capabibilty to perform meaningful surveillance on a limited number of people not to mention act on it. Assuming the majority of people desire not to be tortured or killed far more then they desire freedom. It's probably more effective to simply pretend that you're performing surveillance as an intimidation tactic, than to actually perform surveillance unnoticed. It's also far more socially acceptable on an international level than violence.

tessierashpool 12y ago
Agree & disagree. Re this: Even a government will only have the capabibilty to perform meaningful surveillance on a limited number of people not to mention act on it. That claim is currently true, but if you understand Bayes' Theorem and Moore's Law, you know that it's just a matter of time. But re this: It's probably more effective to simply pretend that you're performing surveillance as an intimidation tactic, than to actually perform surveillance unnoticed. iirc, former East German Stasi or KGB have said essentially the same thing.