Re:Google Can Bring an End to Censorship in 10 Days
by lucb1e on Saturday November 23, 2013 @09:10AM
(#6785950)
I only thought of the Chinese govt issuing a certificate after writing half the post. Initially I was just going to comment on the easy possibility of MITM attacks. These would fail whenever anyone forced https into their address bar, but I think less than 5% of the people do that. That would mean just refusing connections for the <5% and still sniffing everyone else.
[ Parent
| on HN ]
Re:Google Can Bring an End to Censorship in 10 Days
by paulgb on Saturday November 23, 2013 @09:41AM
(#6786017)
Strict transport security (http://en.m.wikipedia.org/wiki/HTTP_Strict_Transport_Securit...) is an attempt to prevent exactly this. However assuming that the user is always on a MITM'd connection, a preloaded list in the browser becomes necessary.
Re:Google Can Bring an End to Censorship in 10 Days
by lucb1e on Saturday November 23, 2013 @01:50PM
(#6786946)
Yes, doing this attack after a site is already publicly known is hard because of HSTS (if Github uses it), but slowly caches will expire and browsers will reset themselves, and the amount of http traffic will increase a lot.