Schrodinger's Cat Video and the Death of Clear Text | Hacker News Reader

Schrodinger's Cat Video and the Death of Clear Text

citizenlab.org

51 points_pius10 comments

Salient point:

  The target is presented with a dialogue to upgrade their
  flash installation [via ISP-based MITM - DenisM]. 
  If this upgrade is accepted the malicious SWF enables the 
  installation of a ‘scout agent’ which provides target 
  validation.

Adopting HTTPS is very important for the Web, but the lack of HTTPS in this case is just a red herring. The real problem is that it's way too easy to exploit systems through the web browser. If the entire Web switched to HTTPS, government attackers would just find another way to deliver their exploits besides injection into plain text websites. Working on solving this problem is just as essential as transitioning to HTTPS.

If the entire Web switched to HTTPS, government attackers would just find another way to deliver their exploits besides injection into plain text websites.

Exactly. HTTPS relies on a centralised CA infrastructure, which is probably (indirectly) under the control of government anyway, so I don't see how taking away the ability to MITM plain text connections will help; and governments would prefer that their exploits be done over HTTPS since a properly-forged certificate will look "secure", and that makes the end-users more likely to blindly trust the authenticity of the content they download... it also means that firewalls and other systems designed to detect suspicious content in traffic (as much as they're derided for being used for censorship-related purposes, ones under the control of the user can be beneficial) won't catch the exploit either. I think that would be even worse.

HTTP causes some suspecion of the content, but HTTPS gives the impression of being secure, decreasing the level of suspicion while implicitly forcing the user to trust the CAs.

HTTPS with self-signed certificates that are exchanged in-person would probably provide the most secure authentication, but that doesn't really scale.

I'm assuming, as there is a live PE executable modification payload listed, and Windows is supposed to throw warnings for unverified / unsigned updates and installers, that the CA infrastructure is already compromised.

Either that or most Windows users still just habitually click through security warnings, which I sincerely hope is no longer the case.

So plain http in plain, static html (no javascript, limited css) is best then...

With tools like these out there, what can we do to protect ourselves? Besides not downloading binaries over HTTP (which still wouldn't protect you if a CA has been compromised) what other steps can someone take? I hate how vulnerable and yet utterly essential our browsers have become.

Ship the public key by post like internet banking in the early 2000s.

This is actually how OpenBSD operates. If you buy an official CD set, the thing ships with keys which are then used to sign downloaded packages.

When the keys go via a side channel, the probability of compromise decreases considerably.

Maybe a stretch, but is this somehow connected:- https://news.ycombinator.com/item?id=8160844 ?

I oddly remembered this comment from my memory trove.

The internet 1.0 was designed so grad students could argue about Star Trek while pretending to publish research

Reply on news.ycombinator.com