3

A country in the Central Asia has issued a law enforcing all the ISPs to decrypt the transit HTTPS traffic and encrypt it with a special certificate issued by the government. Every client is to install the certificate to be able to access HTTPS resources (they just won't work without this). At least some other countries can be expected to follow. Needless to say this means HTTPS is not a sufficient solution to guarantee privacy of the data transmitted between the clients and the servers any more. What are some reasonable/interesting ideas of ways to address this issue practically?

I know about VPN and SSH but this seems a fairly clumsy solution - governments blocking HTTPS will probably block all the easily recognizable top-layer encryption solutions like SSH and VPN too. So, what I am generally interested in is implementing a second layer of end-to-end encryption on the application level.

I am working on an idea of a personal information organizer sort of a web app to store my personal data (including, among other data, passwords, intimate pictures and data like this) on my personal server and access it wherever I go. Needless to say I don't want anybody to be able to intercept the data when I happen to travel to a country where such an anti-ptivacy policy has been implemented.

Improve this question
3
  • 2
    You want to look at HPKP for, if not prevention, then at least detection.
    – user
    Commented Jun 26, 2016 at 15:37
  • 1
    You can tunnel another, safe HTTPS (with your own certificates/keys) inside the compromised HTTPS connection.
    – André Borie
    Commented Jun 26, 2016 at 16:12
  • 2
    @MichaelKjörling - If the user has manually installed the government cert, HPKP will not help
    – paj28
    Commented Jun 26, 2016 at 18:14

2 Answers 2

Reset to default
3

What are some reasonable/interesting ideas of ways to address this issue practically?

GPG encryption, with steganography to hide the fact that you're using encryption in plain sight.

The basic idea you need to avoid mandatory compromise to encryption, is find any data channel that is not blocked and use non-compromised encryption over that data channel.

That data channel could be, but not limited, to any of these (ordered roughly by how practical they are):

  • any type of proxy, web proxy, VPN, SSH. Over custom port if necessary.
  • landline telephone
  • software modem over the voice channel of mobile network
  • shortwave/AM radio
  • satellite phone
  • Wi-Fi mesh network
  • packet switch over spam email or pastebin
  • use or devise protocols that can switch to another protocol mid stream in the same TCP connection
  • sneaker net
  • IPoAC
  • smoke signal

The encryption done on top of this is just regular non compromised encryption. Probably just HTTPS, or perhaps GPG. Doesn't really matter too much.

Improve this answer
0
0

You can try to create a SSH tunnel to tunnel HTTPS through it. I guess this post explains how to perform this in an effective way, otherwise you can find a lot of guides on the web explaining how to create a SSH tunnel.

Improve this answer
1
  • I believe a government blocking HTTPS will block all the easily recognizable top-layer encryption solutions like SSH and VPN too. So, what I am generally interested in is implementing a second layer of end-to-end encryption on the application level.
    – Ivan
    Commented Jun 26, 2016 at 14:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .