I'm a little shocked - they've surely got the ability to do a proper MITM. CNNIC is a root CA for plenty of browsers. Saving it up for when they really need it, maybe?
In China, it's very common for websites to ask people to trust their self-issued certificates. If you want to buy train tickets in China, you end up with this page (https://kyfw.12306.cn/otn) which asks you to trust its own cert.
This AM electrician comes over, guy in his early 30's (not an old timer) has a new iphone doesn't know how to sync and get the old stuff to the new iphone. Doesn't even know that Apple can help him with that. For computer things relies on his brother in law "the computer guy". Thinks Dell makes great "computers". "Don't they?" he says to me. Doesn't even really understand the difference between Mac OS and Windows. [1]
Point being there are tons of people out there that you could get to do practically anything. And they don't know the difference between one warning dialog box and another. It's just all a mashup to them.
[1] Add: By that I mean isn't aware that there is even a difference more than Coke vs. Pepsi is different.
[1] Add: By that, I mean he isn't aware of the things he isn't aware of.
Ease up on the geek rhetoric until you walk in his shoes.
TL;DR, This is what a train station looks like before Chinese New Year [1].
Let's start from Hukou policy: Every Chinese is required to register their information to the government and has to provide a permanent address. This looks similar to most other country. But it goes quite far beyond a simple registration. Your Hukou is associated with a permanent address and in many cases, you are only allowed to do many critical things within the city of your permanent address. For example, your child cannot go to the local schools outside their Hukou address. Changing your address on Hukou is very hard and usually happens in some cases: When you go to university, you are allowed to temporarily change your Hukou under the university's city; 2. If you found a job in another city and your employer is willing to help you to relocate your Hukou address. 3. You married with a local person for several years. Basically, you can understand Hukou as a domestic visa. There are two types of Hukou: Farmer Hukou and City Hukou. Basically, they have different benefits/restrictions. Similar to F1 visa, H1B visa, etc.
Well, why I mention this? Here is some history. 30 years ago, major amount of the Chinese population were farmers. To build cities, you have to let those farmers live in the city and do lots of construction works. Due to the Hukou policy, people are not allowed to permanently migrate, esp. changing their Hukou status from Farmer to City. But there's more opportunities in cities and people could make more money. So gradually, there emerges a large group of people whose Hukou address is out of city but work in the cities. Their family has to in their home town, otherwise their children cannot go to school in the cities.
Every year, people works outside their home town will try to go back during Chinese New Year. Since the fact I mentioned above, there's a huge amount of people. They have to take trains (which is cheaper than flight.) Such yearly migration is quite large, ~3.3B tickets in 2014 [0].
Oh, and here is the answer to your question: Go to the train station is really not an option. It's like black Friday, but in a much larger scale. People have to wait outside for even weeks to get a ticket. To some extend, online ticket system helps. However, because of the throughput of the train system is limited, it's still hard to get a ticket.
0. http://en.wikipedia.org/wiki/Chunyun 1. https://www.google.com/search?q=%E6%98%A5%E8%BF%90&espv=2&so...
Not that buying property may be easy for a migrant worker, but for most cities an 80 square meter property should be enough. Outside of Beijing/Shanghai/Shenzhen that's about a million Yuan.
Just wanted to add some clarification / quantification for a casual reader.
Unless I trust each CA, their processes and every employee who could circumvent them, the current CA infrastructure is inherently unsafe. Self-signed certificates are only marginally less trustworthy (rather than having to compromise a CA, a bad actor would simply have to generate a new certificate and hope that I don't check the fingerprint - and I wouldn't check it).
Root CAs are not really trustworthy. Manually trusting a self-signed cert is, probably, more secure in the long term. You take control of trust, rather than delegating it out to some faceless corporation who can be corrupted or hacked.
That said, I'd be more inclined to trust a self-signed cert of a CA signed one. I don't even know half the CAs that my device trusts, and some I recognise (government ones) I explicitly wouldn't trust.
I too remember something like that, but was under the impression that CAs are still ok.
But of course, judging by the massive downvoting you've gotten, I suppose you're incorrect. I wish those downvoters would explain their viewpoint rather than downvoting...
It said in the article: the most popular Chinese browser Qihoop 360 browser doesn't even giving a warning for the bad SSL cert. "Qihoo’s popular Chinese 360 secure browser is anything but and will load the MITMed page directly."
* The popularity of that browser is way over reported - they tend to report "installed" statistics rather than "used".
* If you read the article you'll see self signed certificates were used for the MitM. From my own research, 360 secure browser just doesn't validate certificates in many circumstances. No CA required.
https://developer.apple.com/library/mac/documentation/Securi...
edit: but only in so much as you trust Apple, as they provide and verify the keys. But... assuming you're using an iphone, this isn't really a new threat vector.
Assuming the majority of people desire not to be tortured or killed far more then they desire freedom. It's probably more effective to simply pretend that you're performing surveillance as an intimidation tactic, than to actually perform surveillance unnoticed. It's also far more socially acceptable on an international level than violence.
Re this:
Even a government will only have the capabibilty to
perform meaningful surveillance on a limited number of
people not to mention act on it.
But re this:
It's probably more effective to simply pretend that
you're performing surveillance as an intimidation
tactic, than to actually perform surveillance unnoticed.
So they just get the gullible.
It might also be other 3rd parties who is doing the MITM.
Anyone can setup a fake free wifi, reroute the DNS system. Some percentage of those "free" service users will press "OK" to let other sniff their "secure" connections.
I get that America means 'USA' in this context. How exactly do US government officials hide the fact that they keep data of everything possible that happens online outside the United States (and doesn't give a damn about what anyone else thinks about it)?
Given the statements of many US senators, after both Cablegate and Snowden I don't think the US tries to hide anything at all.
Is this a known fact? If I wanted to spy on a prominent dissident [1], I would use a variety of methods. Some would be intentionally crude, so that the target feels safer after noticing and defeating them, making the more sophisticated approaches that much more effective.
[1] I recommend visiting the current Ai Weiwei exhibit in San Francisco. It's quite good.
It is hard to tell whether it always is. If they are smart they use a deterrent, which must be visible to work, to decrease the number of potential targets to track, and something well hidden to follow the remaining real/potential troublemakers.
Honesty is a traditional value. Privacy and sovereignty based on the consent of the governed? Not so much.
When the artist Ai Weiwei had his email account compromised by the state, they simply logged into his email webmail UI and forwarded a copy of his emails to a 3rd party email address. They didn't even bother intercepting his email at the network or service provider level.
Edit: > "Apple increased the encryption aspects on the phone allegedly to prevent snooping from the NSA. However, this increased encryption would also prevent the Chinese authorities from snooping on Apple user data."
It's a shame articles keep confusing Apple's harddisk encryption with network data encryption. :\