Hacker News Reader

Comment by guntherhermann | Hacker News Reader

I think this requires some prior knowledge.

From https://palant.info/2023/01/02/south-koreas-online-security-... :

> I’ve heard about South Korea being very “special” every now and then. I cannot claim to fully understand the topic, but there is a whole Wikipedia article on it. Apparently, the root issue were the US export restrictions on strong cryptography in the 90ies. This prompted South Korea to develop their own cryptographic solutions.

> It seems that this started a fundamental distrust in security technologies coming out of the United States. So even when the export restrictions were lifted, South Korea continued adding their own security layers on top of SSL. All users had to install special applications just to use online banking.

> Originally, these applications used Microsoft’s proprietary ActiveX technology. This only worked in Internet Explorer and severely hindered adoption of other browsers in South Korea.

Wowsa!

View on HN

Well... SSL was unsafe then.

The problem came from U.S. cryptography export regulation which makes exportable cryptographic algorithm feasible to crack. Bundled Internet Explorer didn't support good algorithms on SSL.

So, South Korea government wanted to add another security layer. They wanted to state "good to go" algorithm (just like FIPS did), so they built and recommended the encryption algorithm, SEED. And it required ActiveX, because 128 bits cryptography on JavaScript was infeasible then.

The real problem of South Korea is, the slowness of deprecation.

They deprecated ActiveX (and created NPAPI or WebSocket on localhost) in 2014. After Microsoft deprecated Windows XP, they established "Windows XP Task Forse" to respond security issues with Windows XP computers on government agencies. Yeah, this was fairly late, considering MS declared the Windows XP deprecation schedule in 2007.

IE/ActiveX/Java Applet/etc algorithms aren't still completely deprecated in Korea. NEIS, a giantic service used by every K-12 school to record and manage education-related information, still uses the technology based on Internet Explorer by using IE compatibility mode of MS Edge. Repeat, EVERY K-12 school teacher and staff uses this service, with IE compatibility mode.

I want South Korea to adapt new technology and deprecate old one more in due course. I mean, they should accept TLS provides decent end-to-end encrpytion, and they should recognize Triple DES is deemed unsafe algorithm.

> All users had to install special applications just to use online banking.

This happened here in Brazil as well, perhaps for similar reasons. Most banks require users to install a "security module" in their computers in order to even log into the bank website. Everyone does this unquestioningly, there's even packages for Linux.

In my experience, this software caused massive performance issues. I tried to figure out why by reverse engineering one of these things and it turned out it had a Windows driver that intercepted every single network connection. Literally indistinguishable from malware but this is apparently considered acceptable because banks have a "legitimate interest" in preventing fraud or whatever.

We have a GDPR-like law in effect now, not sure if banks can get away with this anymore. I certainly hope not.

I’ve also wrote a comment on the context of how these ugly programs got adopted on [0].

To quote myself…

> Everybody knows that the systems are absurd. This is basically a countrywide legacy that we’re figuring our way out for ~30yrs.

> When the idea was first proposed, it was when IE didn’t have a yes/no dialog to ask whether to load native code or not.

> When IE first added ActiveX confirmation dialogs, banks instructed customers to press yes. When IE deprecated ActiveX, banks didn’t remove their 20-yr old code straight away; people were advised to turn on ActiveX support from advanced settings (they added step-by-step instructions to help people). When MS finally ripped out ActiveX, banks copied their ActiveX components into a separate executable that runs a localhost server.

I’m sure that if it wasn’t iPhones, South Korea would have been locked into this legacy for a lot longer. (In fact, we once had versions of these programs for Android as well! iOS didn’t allow this (thankfully).)

[0]: https://news.ycombinator.com/item?id=34313137

Of course one issue here is while it's probably acceptable for South Koreans to trust Chrome, Windows, MacOS, Android and iOS (and also Intel and Ryzen CPUs), it's probably not for their biggest companies (including banks ?) and their government whose security threat likely includes US espionage.

And yes, this might seem silly considering the garbage fire revealed by TFA, but maybe they can use this crisis to jump one extra generation over that security threat too ?

What about people using Apple computers? Were they simply advised to borrow something capable of running Windows from a friend?

It was common 5~10yrs ago to either have a spare Windows laptop or buy Parallels Desktop for handling bank/govt things. Nowadays, macOS got common enough that some of these ugly programs now have a macOS-specific version. :( Some even have downloadable deb/rpm Linux binary packages.

Some softwares: Yes. People with Mac are advised/forced to use Windows. For instance, Uwayapply, a college admission application service, doesn't support macOS.

Or: they provide .pkg file to install similar program.

Most of them want sudo. They use root permission for various purpose, but the most impressive one for me was registering their CA certificate on Firefox root store, to support WebSocket over TLS to localhost on Firefox.

Nice! That way you can extract the private key and cert from the app and spoof the local server! I bet that cert is valid for *. and the same on every machine as well?

That situation was pretty normal if you used Macs back in the day, for many workflows. Virtual PC on PPC Macs were a godsend in many situations in the late 1990s.

> Originally, these applications used Microsoft’s proprietary ActiveX technology. This only worked in Internet Explorer and severely hindered adoption of other browsers in South Korea.

This basically reveals that the pretext of this being primarily about increasing security of the connection is not really what it is about.

From having read about this, I think it is completely fair to classify this as spyware.

If at any point a government tells you they are doing something to increase security, or to be tough on crime, or to protect children, it is almost certain they are lying to your face and in fact just want more ways to spy on people.

More likely a massive and internally unrecognized incompetence than some black project from sneaky agencies. I remember some experts in 2000s fighting months to convince banks that TLS with self signed certificate is the way to get customers scammed.

But isn't that sort of true? How can I know what self signed certs to accept and which ones to reject as scam attempts?

I'm not sure if there was such a "fundamental distrust" ever. It is more easily and adaquately explained that they simply followed the path of the least resistance, which is a status quo.

ActiveX-based plug-ins for online banking weren’t exactly SK-specific in the 2000s. I’m surprised these (I mean the no longer ActiveX-based successors) are a still a thing, though.

Reply on news.ycombinator.com