Hacker News Reader

Comment by jonawesomegreen | Hacker News Reader

I hope that this drives home the need to be using HTTPS everywhere we can be. It would make this kind of wide scale man-in-the-middle attack much harder to pull off and easier for users to detect. If only getting a certificate was an easier (less costly) process.

View on HN

When considering the effectiveness of HTTPS everywhere, we should assume the Chinese government will have the ability to create valid certificates.

This would allow them to perform MITM attacks against anyone who visits Chinese websites, even with HTTPS.

They need to sign those certs with a CA. If they do this, they create a cryptographic proof that they're abusing their trust and are removed from the trust store quickly.

In fact that happened about a week ago:

http://arstechnica.com/security/2015/04/google-chrome-will-b...

But if China chose to, they could simply require all Chinese websites to use government-issue certificates, forcing the world to choose between allowing Chinese MITM monitoring and losing access to China.

> But if China chose to, they could simply require all Chinese websites to use government-issue certificates, forcing the world to choose between allowing Chinese MITM monitoring and losing access to China.

The more likely outcome of that gambit would just be that the CA would be restricted to .cn domains, possibly with some sort of install-on-demand warning.

That would not necessarily prevent attacks like the GitHub attack, which used embedded analytics JS from Baidu, IIRC.

Actually, it would have stopped this particular variant because Baidu serves the script from baidu.com:

http://www.netresec.com/?page=Blog&month=2015-03&post=China%...

That said, it would only matter if Baidu was doing something like serving the script only over HTTPS using HSTS which I imagine would incur a non-trivial backlash for them.

I'd also be surprised if they couldn't relatively easily move on to another similarly insecure script requested by many people outside of China.

> The more likely outcome of that gambit would just be that the CA would be restricted to .cn domains, possibly with some sort of install-on-demand warning.

A reasonable compromise, but one which wouldn't prevent MITM snooping or alteration of communications with Chinese websites, like this attack.

And to allow snooping of outgoing communications, the Chinese could also require that all browsers used in China trust the Chinese government CA without that restriction.

Agreed, although it technically would have helped against attacks like the ones we just saw where most of the parties involved – including Baidu – are using .com domains. No question, of course, that this would only result in heavy pressure on everyone doing business in China to use .cn domains.

Coincidentally, Google Chrome and Firefox recently blocked a Chinese root authority from issuing SSL certificates. (AFAIK, the only default Chinese authoirty). The stated reason has nothing to do with censorship attacks, but it is an interesting coincidence. http://arstechnica.com/security/2015/04/google-chrome-will-b...

Remember to remove Chinese CAs from the Trust Stores in the OS and browser. Unfortunately this is not very easy in some cases. And next update might add them back again. We really need better Trust Store management as a user. We should be allowed to define what CAs _we_ trust.

Which underscores the need to use additional authentication measures like DANE [1] and key pinning. Making it harder for malicious entities to wriggle their way into connections seems vital here.

[1] http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Nam...

Just installed little snitch.

Almost every app on my mac is trying to access some resource on the web, most of them over port 80 or a mix-and-match of both 80 and 443. And then the OS itself has a variety of services that does the same. My computer is like a beacon of light that shines it's position and personal information to everybody.

Also a user of Little Snitch. (A great OSX tool btw). I've started to block all accesses that are not to 443, just to see what breaks. One of the worst offenders is iTunes.

Non-browser software is notorious for failing to fail when certs don't validate.

More than that, it drives home the need to disable JavaScript by default. To do otherwise is inviting every web site you visit (and every third-party site they load content from, and everyone who can compromise either) to run arbitrary code on your system.

And it drives home the stupidity of sites which demand JavaScript to view even simple content which could just as well be static.

I totally agree. I started using Cloudflare's free service to add HTTPS support to my most important sites. I have some concerns about routing my traffic through another company, but free is free and I really think people need to transition to HTTPS everywhere.

Well, they sometimes block HTTPS traffic; e.g. for Wikipedia (even just wikimedia right now).

Would they be able to block HTTPS traffic if it effectively meant that they were blocking the internet though? I think people would have a bigger problem with that.

If all websites went https, they would try to block everything, definitely.

Reply on news.ycombinator.com