Hacker News Reader

Comment by zeta0134 | Hacker News Reader

That's just it; they can't! When you visit Wikipedia over HTTPS, the only thing actually visible in plain text is wikipedia.org, and that's only if your browser is using Server Name Identification (SNI).

Since the rest of the request, including the URL is hidden, governments and other malicious agents between you and the server cannot actually see what pages you're requesting directly. They can only see that you are accessing wikipedia.org and transmitting some data. You may still be somewhat vulnerable to timing attacks to try to identify what pages you're viewing, but censorship can't happen at the page level over HTTPS; you have to block the whole thing in one go.

View on HN

The article says

Although countries like China, Thailand and Uzbekistan were still censoring part or all of Wikipedia by the time the researchers wrapped up their study

The top comment might be asking about the "were still censoring part" of the article.

Oh, huh! I missed that entirely, now I'm curious too. HTTPS should make that difficult, but China has been known to employ all sorts of weird shenanigans-- perhaps they're running a "trusted' MitM as part of the great firewall?

I know that certain companies (like Google and Microsoft) will actively censor themselves to continue to operate within China, but I figured Wikipedia would be against that practice on principal. Now I'm curious as to how it's done.

Nitpick: Google opted to pull out of mainland China instead of self-censoring. They moved Chinese operations to Hong Kong, but operate uncensored there.

Google was perfectly willing to self-censor in China until they were hacked by the Chinese government in 2010. That's when Google China moved to Hong Kong.

https://googleblog.blogspot.com/2010/01/new-approach-to-chin...

I think china blocks zh.wikipedia.org but all other languages are not blocked.

I just tested a few pages and it looks like you are right.

When I visited China a bunch of years ago, zh.wikipedia was completely blocked, and on English wikipedia, only certain articles were deadholed (tiananmen square...)

This is how "domain fronting" (https://en.wikipedia.org/wiki/Domain_fronting) works as well -- encryption makes blocking an all-or-nothing deal, and blocking everything that goes to an extremely popular IP range / SNI causes too much collateral damage :)

For committed governments like China, TLS may just be an extra hurdle but they can get around it if they want. Basically China could simply implement a massive proxy that terminates TLS.

If your internet traffic is going to flow through infrastructure that a curious government owns, then you'll know that they're monitoring the traffic but there is no way to keep them from seeing what you're doing.

No, TLS is not vulnerable to a MITM unless a) your client trusts the certificates issued by the attacker, or b) the attacker successfully forges the certificate of the website you are trying to visit.

That is, assuming you don't click away your browser's security warning.

https://security.stackexchange.com/questions/8145/does-https...

It isn't but if you live in China and want to use the internet, you'll likely be forced to use a proxy that MITMs and serves its own certificate....My point is that TLS is not a solution to prevent government interference when the user has to rely on the government infrastructure for access.

This is not how the great firewall works, check the facts known, not just baseless speculatation.

Not how it currently works. The parent was referring to hypothetical future changes.

> TLS is not vulnerable to a MITM unless a) your client trusts the certificates issued by the attacker,

Or in other words it is vulnerable.

China can (and probably does) issue a certificate that all Chinese browsers must install, they can then do MITM https using their certificate to sign the new versions.

Companies do this routinely BTW. Since it's their equipment, it's considered just fine. (But be aware of it if you are using a company computer.)

do you have any examples of China issuing a certificate that all browsers trust?

I've never seen or heard of this (at least across all browsers), so I find this unlikely.

https://security.googleblog.com/2015/03/maintaining-digital-...

"On Friday, March 20th, we became aware of unauthorized digital certificates for several Google domains. The certificates were issued by an intermediate certificate authority apparently held by a company called MCS Holdings. This intermediate certificate was issued by CNNIC."

There is a concern dating back many years that a government will mandate that UAs trust a particular government-controlled CA (that eventually, but maybe not at first, openly performs MITMs). This is one reason that browsers really want to keep control of their root programs and not be mandated by governments to include any particular trusted roots -- including to maintain a remedy against roots that do appear to deliberately facilitate MITMs.

Although there have been lots of concerns about CNNIC, I don't believe that the Chinese government currently either (1) routinely uses CNNIC to perform MITMs for censorship or mass surveillance purposes, or (2) purports to require UAs to trust CNNIC or another Chinese root in order to be used by Chinese users. I'm happy to be corrected if someone knows otherwise.

They wouldn't "routinely" abuse their root to monitor large populations. That would be too obvious and result in near-immediate loss of their precious root.

What's more dangerous, and much more likely, is that they might use forged certificates against specific individuals for a short period of time, for example, to intercept login credentials. The attack will go unnoticed as long as they also block the corresponding HPKP reporting URL (if the targeted site uses HPKP at all).

I think this distinction is a good one, and I'll try to be more attentive to it when writing about this in the future.

Hopefully the risk for the attacker from the two kinds of attack are gradually converging, due to pinning and especially Certificate Transparency.

revoking the root outside china will have no bearing within. All devices sold and used in china could be forced to include that root. There is not a lot a user could do , especially in mobile if you have locked phone and only access to the official app store

There's a fine line between cartoon-villain evil, exemplified by people like Kim Jong Un who just doesn't seem to give a fuck, and just-enough-to-achieve-your-objectives-but-not-enough-to-make-too-many-people-notice evil, which is what China is aiming at.

Lots of people travel in and out of China with all sorts of computing devices. China does care about the reputation of their root and of their highly profitable electronic exports.

They don't need one all users trust as a lot of Chinese users will use Chinese browsers and those are already compromised.

https://en.greatfire.org/blog/2014/oct/china-collecting-appl...

Note that the server certs are also parsable even if you're not using SNI.

DNS requests are still transparent

Reply on news.ycombinator.com