Thai government to MITM all internet communications

Re:Thai government to MITM all internet communications by matthewaveryusa on Monday May 30, 2016 @12:19PM (#11801964)

I think they'll go the simple route: They;ll install a root CA that signs all other CAs going through to mitm. People will get warnings and just install the root CA. The government will probably be helpful by giving you links to browser binaries that already have the root CA installed. Of course their systems will be hacked by the americans, russians, israelis and chinese, at which point all of these entities will be able to mitm the mitm - mitm-ception!

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by PeterisP on Monday May 30, 2016 @12:52PM (#11802087)

Cert pinning doesn't just give warnings, it simply refuses connect over MITM, period. Just a few days ago I was at some airport wifi hotspot that was MITM'ing things, my android phone simply refused to go to https://google.com with a warning about this and no option to accept the cert signed by their fake CA.

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by fulafel on Monday May 30, 2016 @01:32PM (#11802258)

Unfortunately browsers exempt locally installed CAs from MITM countermeasures, to support employer/school mandated domestic surveillance in the USA.

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by pcl on Monday May 30, 2016 @02:12PM (#11802389)

Do those bypasses apply for HSTS-preloaded certs as well? My understanding is that the intention of HSTS preloading is to address this sort of attack, but haven't dug through the browser code to see what's happening in standard distributions.

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by ikeboy on Monday May 30, 2016 @02:25PM (#11802432)

Yes. It's explicitly not part of their threat model: https://www.chromium.org/Home/chromium-security/security-faq...

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by niij on Monday May 30, 2016 @02:59PM (#11802552)

If you have a Root Cert installed on your system, and they are MITMing traffic to a HSTS site with that Cert then your browser will give no warnings (for HSTS or non-HSTS sites).

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by gruez on Monday May 30, 2016 @02:28PM (#11802442)

The point of HSTS (and preloading) is to protect clients from sslstrip (and similar attacks). as in, client types in a http url, and the attacker prevents the http connection from being upgraded.

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by pcl on Monday May 30, 2016 @03:01PM (#11802558)

That's one of the goals of HSTS itself, but preloading designed to allow secure-only communications when establishing a connection to a hitherto-unused site, so that MITM attacks can't simply provide their own certs on first connect.

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by Klathmon on Monday May 30, 2016 @12:59PM (#11802119)

But locally installed certs can bypass that restriction in all major browsers.

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by robryk on Monday May 30, 2016 @01:00PM (#11802123)

Well, so they will helpfully supply browser binaries that have cert pinning disabled?

Though I don't see how they will manage that for mobile browsers.

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by Canada on Monday May 30, 2016 @12:31PM (#11802008)

I think that it will be just like the single gateway in general - there's some technically incompetent talk about it and absolutely no action.

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by geomark on Monday May 30, 2016 @08:06PM (#11803878)

Word is that the single gateway is moving forward toward implementation. They just stopped talking about it.

My guess is that they will attempt to do what is being talked about. If it breaks the internet in Thailand they don't care. The junta and their masters don't really understand and don't use it. It's just a toy to them and a place that is used to spread speech they don't like. The royalist elites that the junta are focused on protecting have their private bankers and underlings to take care of things so they don't care if internet banking is broken or if social media breaks. All that matters to the junta is protecting their core interest group of royalists.

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by ikeboy on Monday May 30, 2016 @02:29PM (#11802448)

Is there a way to leverage such access into secure browsing? Some kind of "secure https" over "mitm https", where they only see the encrypted layer even with their mitm access?

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by matthewaveryusa on Monday May 30, 2016 @07:20PM (#11803759)

You can go over a VPN. I use the VPN my corporation provides as I deem them trustworthy. Before this I used an AWS EC2 instance and did a poor man's VPN using sshuttle[1] . I've also done it using sshuttle to a NAS I have sitting in my living room.

[1] http://www.unixmen.com/sshuttle-poor-mans-vpn-ssh/

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by geomark on Monday May 30, 2016 @08:19PM (#11803907)

When you connect to a VPN doesn't it do key exchange in the same way as making a https connection to a website? They would just MITM that as well, right?

[ Parent | on HN ]

Re:Thai government to MITM all internet communications by Natanael_L on Monday May 30, 2016 @03:09PM (#11802588)

You can easily do double tunneling, sure. Or even tunnel over DNS. Or over ping packets.

[ Parent | on HN ]