Hacker News Reader

> If you don't trust Nokia, don't use their phones.

There's a rather big difference in trusting their phones vs. trusting their services in this case:

Mobile network vendors (including Nokia's NSN) have a record of being very very helpful in supporting government wiretapping. see eg http://www.washingtontimes.com/news/2009/apr/13/europe39s-te...

This is a much bigger problem in China, etc (the "emerging markets" under discussion) than in the west.

It's much less likely they've built backdoors into the handset, and if they do they risk getting caught.

> They are providing a service that users are opting in to use.

No, there's no opting in to the violation of end-to-end security here.

The funny thing is, Nokia's Xpress Browser did the opposite (for a day), allowing people in China to browse any site on the internet. It worked like a secure proxy or VPN, punching a hole through the Great Firewall. Until China caught on and blocked the IP addresses of Nokia servers.

http://www.wpcentral.com/nokias-xpress-browser-has-been-bloc...

> Mobile network vendors (including Nokia's NSN) have a record of being very very helpful in supporting government wiretapping.

I think the major issue is that you cannot 'sell' any core mobile network-devices without: http://en.wikipedia.org/wiki/Lawful_interception

So "very helpful" is kinda debatable in my opinion.

If you read the linked Washington Times article, the "monitoring centers" sound like separatete bells-and-whistles products that are not the same as the mandated LI mechanisms.

Lots of other vendors market these government espionage tools to autocratic regimes too. Eg Bluecoat, Cisco etc.

At any rate it feels bad that we have to appeal to these human rights abusing autocracies, it's not any better to have these mechanisms built into the western networks.

Wrong. It is an MITM issue. GMail and Twitter are free to offer non-SSL service but they choose not to.

Also I'm very doubtful about the economics of offering a phone with a weak CPU and memory configuration. Aren't screens a big chunk of the price?

I don't think the issue is quite as black-and-white: does the physical location where a computation is performed really of any importance in this case?, You don't have control over what's going on in the hardware anyway. I'm not condoning Nokia, but I really don't see any difference here.

If I use Thunderbird to send an email to foo@example.com, via Gmail, submitted with TLS encrypted SMTP on port 587, and Google decrypts my transmission and forwards it to mail.example.com unencrypted, is Google performing a MITM attack on my communication with example.com? No, they are providing the service I requested.

The Nokia browser is essentially a thin client that communicates with a remotely hosted web browser. The remote web browser, running on Nokia's servers, does all the complicated JavaScript and advanced CSS stuff, and converts it to a dumbed down version that can be displayed on the phone.

There clearly is a cost savings in using low-end parts. Not all screens are created equal, for example the Nokia Asha 306 uses a 240x400px resistive touchscreen. If you have ever used a phone with a resistive touchscreen you know how bad they are. It also has 32MB of RAM, 10MB of user storage, 2G data (not 3G), and no GPS. You can't run a WebKit + V8 browser on a phone with those specs, you just can't.

The BOM for a Nokia Lumia 900 (high end, with a 480x800px capacitive touchscreen) is here: http://www.isuppli.com/Teardowns/News/Pages/Nokia-900-Carrie...

In your example the certificate you're being given when connecting through SMTP is for smtp.gmail.com.

It is this certificate that proves your connection is to smtp.gmail.com and not somebody else. That's the whole freaking point of HTTPS. What Google does from there, it's their business, but NO, they are not the man in the middle, as you explicitly and willfully connected to them and allowed them to send email on your behalf.

On the other hand, connecting to HTTPS with one of these Nokia phones leaves you with the impression that HTTPS connections to google.com are secure, when in fact the Nokia device is LYING TO YOU.

The example you've given couldn't have been any worst.

Nokia is not faking certs. The "browser" only talks to .browser.ovi.com and the SSL certs are issued to .browser.ovi.com. SSL is working exactly as they should. The "security researcher" didn't understand the results he was seeing and freaked out. The Nokia phone only does a DNS lookup of .browser.ovi.com, it only connects to .browser.ovi.com, and it only gets an SSL cert from .browser.ovi.com.

Here is post from the "security researcher", so you can see who the certs are issued to: http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/

Except GMail and Twitter's intent in offering SSL is not to offer it to .browser.ovi.com but to offer it to users' devices.

The expectation of using an SSL connection is that there will be end to end encryption. This is not the case here, and the user should be informed and given the chance to opt-in.

except most people don't know what SSL is, and how it applies - other than that padlock. IN this case, the padlock doesn't prevent nokia from eavesdropping on you. But when asked, a non-technical customer wouldnt know or understand this, and thus opt in, where as if they did understand it they won't opt in.

But we are the technical users. And we just found out a bad thing, that affects non-technical users. It's our responsibility to highlight this.

An interesting question, if Nokia informed their customers before the purchase would they have still bought the hardware? It's not really quite as altruistic of Nokia they don't put the cards firmly on the table before hand.

Do they have to educate their customers as to the meaning of terms like "SSL" and "encryption" as well? Otherwise many won't know what to make of it.

Simple analogy: Dealer wants to sell you a car, but requires installation of an internal monitoring camera.

How is this in any way analogous to the Nokia situation? Nokia aren't passing traffic through their proxy because they want access to your data, they're doing it because your device isn't powerful enough to perform the necessary computations itself.

It's a privacy concern as it is. Please don't muddy the waters by spreading FUD and conflating this with something it's not.

Lets say I run a mail forwarding service. I get your permission to go to each of your mail boxes and send your mail to where ever you happen to be. Mail is heavy though and to save you money I open all your mail remove a couple of pages / brochures / ads, reseal it in the original envelope and don't tell you.

I promise I don't read your mail when I get caught.

I'm giving the first 3 months free, please provide your information below so I can get started today!

Dealer wants to sell you a car, but installs an internal monitoring camera to do maintenance in order to see the condition of the roads you drive on. But doesn't tell you.

Nokia is a company run by big men and women they could very well come up with an analogy.

Saying it's OK to not tell someone something important because you don't respect the intelligence of the person or people it considers is well, wrong.

If they don't want to be accused of MitM, the onus is on them to spell it out as to why Nokia's "browser" isn't as safe as a normal browser.

> If you don't trust Nokia, don't use their phones

Well duh.

Remember how a while ago Nokia got a bit of bad press about developing the DPI technology for Iran and Egypt? (together in a joint venture with Siemens).

So they made a press release[1] about how it has come to their attention that this technology was being used for human-rights abuse (GASP you don't say?). As a result they "halted all work at monitoring centres" and promised they wouldn't do it again.

And now there is this. It is not quite as severe, but it's the very same careless attitude regarding people's privacy in contexts were this privacy really really should be maintained.

It seems pretty obvious they do not care, each time until they're caught red-handed.

So IMO, you can leave the "if" out of that statement and shorten it to "don't trust Nokia".

Shame on Opera for being part of this, too.

> The maker of the software and hardware always has the capability to add eavesdropping code if they want.

Well that's the point, isn't it? You always need to trust your hardware manufacturer that they won't do this. Developing DPI technology for oppressive regimes does not quite engender this type of trust. Nokia has to do a little bit more than just a press release before they earn that basic level of trust again (if ever).

[0] http://www.nokiasiemensnetworks.com/news-events/press-room/c...

[1] http://www.nokiasiemensnetworks.com/news-events/press-room/s...

I'm sort of confused as how this works. If it is not a MITM attack (i.e. using false SSL certificates), then how is Nokia readily decrypting data? I thought SSL was relatively non-trivial to crack.

Your phone is basically just remotely using a browser on Nokia's servers. Their servers are the ones actually initiating the SSL connection.

Got it. I think the title of the article is misleading when it says they decrypt the data. It's true of course, since they hold the client certificate. I hope data is ferried to their server in an encrypted format at least.

It's not a web browser in the way you are thinking of. It's a client for a Nokia service. The client does not attempt to connect to a website, instead it asks the Nokia service to render a website and provide a rendered version.

These phones are too under-powered to render modern web pages. It's either this or they have to view only WAP pages. If you have never used WAP on an old phone, go login to Yahoo Mail at http://wap.yahoo.com/

http://www.opera.com/mobile/specs/ Opera Mini in that picture is basically the same as the Nokia browser. You are not client, you just control remote client that will communicate with web server, retrieve data, process them and display them to you.

Overly complicated comparison would be you controlling browser on a remote desktop. Nothing has to be cracked, yet you can see data on your computer while the other computer can see them too.

> The Nokia Xpress Browser is not an HTTP web browser.

And yet there is confusion around it. The onus is on Nokia to educate their users that it isn't as secure as a HTTPS web browser.

>If you don't trust Nokia, don't use their phones.

You are right. And now I don't trust Nokia, after reading this news.

There is no browser for the Lumia phones other than Internet Explorer - they don't allow alternative browsers in the WP marketplace.

Yes, they allow alternative browsers. I've seen web browsers on the marketplace (SurfCube, for example) completely functional. What I'm not so sure is if they allow browsers using other rendering engines than Trident (i.e., they don't use the native WebBrowser control).

These are not alternative browsers. They are alternative UIs to the same browser engine (sometimes with a worse JS engine…). Just like Chrome on iOS.

Nokia Xpress is available for Lumia[1]. Just like Apple doesn't allow alternate browser engines on iOS, but it allows Opera Mini[2] because Opera Mini isn't a full web browser, it's a client for Opera's transcoding service. Nokia Xpress isn't a full web browser, it doesn't execute JavaScript, it is a client to Nokia's transcoding service.

[1] http://betalabs.nokia.com/trials/nokia-xpress-internet

[2] https://itunes.apple.com/us/app/opera-mini-web-browser/id363...