Man jailed for over 5 years and fined $76K for selling VPN in southern China

Re:Man jailed for over 5 years and fined $76K for selling VP... by QAPereo on Friday December 22, 2017 @12:33AM (#15985468)

Yeah, and mind you the UK under May and the US would almost certainly love to do this too. Demonize encryption and anything which might allow you to bypass either monitoring, ISP fuckery, or copyright law. There’s probably no technical solution for a government to do this, but as with rubber hose crypto, they don’t actually need one. If we don’t want this in our future, it’s going to take a lot of work.

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by confounded on Friday December 22, 2017 @01:34AM (#15985659)

We need to provide a united voice. And that is probably via some kind of organization outside of our respective monopolistic corporations.

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by nurettin on Friday December 22, 2017 @12:49AM (#15985516)

I'm surprised people actually trust their browser encryption. All it takes to decrypt is for a government to ask for your ISP's reverse proxy logs or acquire a bunch of root certificates.

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by Benjamin_Dobell on Friday December 22, 2017 @01:00AM (#15985558)

How are "reverse proxy logs" in any way useful for decrypting SSL?

Root certificates aren't useful either unless users install them. On the other hand, private keys of SSL providers can be of use for serving false certificates, but that's only useful if you also MITM.

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by turblety on Friday December 22, 2017 @01:12AM (#15985604)

The problem with root certificates is there are so many of them installed by default with your operating system.

As of writing this message I currently have over 170 root certificates on my macOS. Some of them are from companies who are known to care very little about your privacy. There's even a "Federal Common Policy" certificate which is actually run by the US government [1]

If the government did MITM you're traffic, it would still show in the certificate chain. But how many people really check this every time they visit a site?

1. https://security.stackexchange.com/a/71174

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by willstrafach on Friday December 22, 2017 @09:58AM (#15987840)

1. It is a calculated risk to MitM this way, if someone notices the cert is different than what everyone else sees, there would be pretty major blowback.

2. Regardless, Certificate Transparency means it will almost certainly be noticed.

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by nurettin on Friday December 22, 2017 @01:51AM (#15985711)

Reverse proxy is part of the MITM. Every sizeable work place in my country has some sort of root certificate installed on every workstation's browsers. They log your traffic and use those root certificates to decrypt your traffic. -1 all you want.

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by kurthr on Friday December 22, 2017 @01:32AM (#15985655)

Which you can assume on some I flight Wi-Fi... https://arstechnica.com/information-technology/2016/02/why-y...

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by AgentME on Friday December 22, 2017 @02:23AM (#15985814)

Most HTTPS connections use Forward Secrecy, so even if a government records an encrypted HTTPS connection and then later gets access to the private keys of the relevant TLS certificates, they still can't decrypt the recorded connection.

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by stctgion on Friday December 22, 2017 @03:21AM (#15986017)

It's still possible for the government to apply pressure so that ISPs man in the middle and force weaker ciphers that can be decoded after the fact

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by willstrafach on Friday December 22, 2017 @09:55AM (#15987824)

They cannot force weaker ciphers. TLS specifically won’t allow it due to past attacks relying on this.

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by AgentME on Saturday December 23, 2017 @06:57AM (#15993878)

Everyone would notice if ISPs were man-in-the-middling their TLS connections because none of the TLS connections would work.

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by pgo on Friday December 22, 2017 @02:26AM (#15985827)

You don't understand the web's chain of trust.

[ Parent | on HN ]

Re:Man jailed for over 5 years and fined $76K for selling VP... by testestx on Friday December 22, 2017 @02:00AM (#15985740)

That's why browsers pin the certificates of certain sites.

[ Parent | on HN ]