Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Correct me if I misunderstand the following quoted paragraphs, but basically to compress something it must be decrypted first. This seems to be the claim of the article but I don't see this as true. For example if a01 10b a01 is encryupted to ccc c02 ccc then compression can still happen e.g. substitute x for ccc

Anyways assuming it is true, is there a legitimate security risk that Opera is intercepting traffic going through it when compression/turbo mode is enabled? If this takes place on the local computer with Opera installed I don't see this as a problem but if it takes place on a remote server then I would see the security threat. Does the compression take place locally? It must, how else would it be effective when it already needed to travel the internet?

From https://www.grc.com/fingerprints.htm

Nokia caught secretly decrypting mobile browser traffic: ZDNet reports security researcher Gaurang Pandya's discovery that the “secure” HTTPS traffic from his web browser was being decrypted by Nokia's servers. (See the link.)

Nokia's reason is valid: Encrypted data appears as pseudo-random noise and cannot be compressed. But they did this secretly and there's no way to disable it. Opera's Mini browser does the same thing for the same reason, but makes it optional and explains it clearly. And while Nokia says they would never pry, the fact is that since they CAN, in the USA they could be compelled to do so.

share|improve this question
    
Data encrypted with a secure algorithm is uncompressible. If you substitute ccc by X, then you need to substitute something else for X, which is probably longer than one character. Encrypted data is indistinguishable from uniform random data and there is no algorithm that can compress such data on average. –  CodesInChaos Aug 31 '13 at 18:28
add comment

1 Answer

up vote 3 down vote accepted

Firstly, take anything Steve Gibson says with a grain of salt. In fact, a truckload of salt might be more appropriate.

Your worry is completely unfounded. Have a look at Opera's privacy policy section on Opera Turbo. It explicitly mentions that any web sites located on an intranet or served through HTTPS is excluded from the service. This means that on an encrypted connection, you will be talking directly to the web server you want.

Does the compression take place locally? It must, how else would it be effective when it already needed to travel the internet?

You do not understand how Opera Turbo works. The service works by compressing the webpages before sending them to your browser so you have less data to download. It's the complete opposite of what you state, it must occur remotely or else it would be completely ineffective.

Let's have a look at some of Gibson's claims.

Any corporation, educational institution, or other Internet connectivity provider who wishes to monitor every Internet action of its employees, students or users—every private user ID & password of every social networking or banking site they visit, their medical records, all “secure” eMail . . . EVERYTHING—simply arranges to add one additional “Pseudo Certificate Authority” to their users' browsers or computers. It's that simple.

Sure. If I can install anything I want on your system, I can completely own it without you even noticing anything. Big whoop. There are legitimate reasons for intercepting SSL traffic including scanning for malicious traffic. Bottom line, if you don't want this to happen don't let anyone install stuff on your systems freely.

share|improve this answer
    
I'd take privacy policies with a truckload of salt as well. –  CodesInChaos Aug 31 '13 at 18:30
    
Silly me I did understand Opera Turbo backwards. –  Celeritas Aug 31 '13 at 23:41
    
@CodesInChaos In this case, it would be quite easy to verify. Just run wireshark and see which servers your HTTPS connections are hitting. –  Terry Chia Sep 1 '13 at 3:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.