Hacker News Reader

Comment by brunnsbe | Hacker News Reader

What kind of security professional is this Gaurang Pandya? As far as I know it's common knowledge that both Nokia (on their Asha-series) and Opera Mini uses a proxy server to compress the data.

From Opera Mini's wikipage (http://en.wikipedia.org/wiki/Opera_Mini): "Unlike straightforward web browsers, Opera Mini fetches all content through a proxy server and reformats web pages into a format more suitable for small screens."

And on Nokia developer's home page (http://www.developer.nokia.com/Develop/Series_40/Nokia_Brows...): "The Nokia Xpress Browser comprises a client and a cloud-based proxy service. When a user requests a web page the proxy reads the page, processes CSS and JavaScript code, and compresses its content, which is then delivered to the client for display on the user's phone."

View on HN

You'll notice that the page doesn't say: "We route your banking and other sensitive personal information through our servers and are at liberty to inspect any financial transactions conducted through this phone, this process works similarly to the great firewall of China."

Many services use proxies to speed up connections, few do it with SSL, and even fewer forge their own certs.

If part of the rendering engine runs in their servers and not in the phone, there's no chance of keeping the end-to-end encryption. Their servers need to decrypt the traffic to render it and then (hopefully!) re-encrypt it to safely deliver it to the phone. This is exactly the same as with Opera Mini and Amazon Silk.

> You'll notice that the page doesn't say: "We route your banking and other sensitive personal information through our servers and are at liberty to inspect any financial transactions conducted through this phone

It says "When a user requests a web page the proxy reads the page ... which is then delivered to the client for display on the user's phone."

So if your "banking and other sensitive personal information" is a web page, then it does indeed say that.

Opera Mini is not a web browser; it can't process and render HTML+CSS+JavaScript, it only displays what the proxy servers tell it to (they do all the processing). So, you can't reasonably expect it to fetch HTTPS content and render it by itself. Especially since it's made to run on low-end phones.

This is exactly why my bank blocks out Opera Mini. Which is excellent of them. I use Mini for everything except banking now, and it works like a charm

But if Nokia can go to the extent of forging SSL, what stops them from using a different User Agent and pass through the block?

Reply on news.ycombinator.com