6

Kazakhstan has forced all users in its territory to install a state-issued SSL root CA certificate "aimed at enhancing the protection of citizens, government bodies and private companies from hacker attacks, Internet fraudsters and other types of cyber threats."1

The consequences is pretty straightforward: Anyone who controls the root CA knows everything you send through HTTPS, including your login passwords (provided the website relies on TLS-encrypted connections), your submitted forms and your credit cards.

In this case, is it still possible to send anything to a website, without any 3rd-party being able to intercept the connection and any data transmitted? Is there any way to avoid this MITM, or mitigate its impact?

  • 1
    Not an exact duplicate but you may be interested in this: security.stackexchange.com/q/194353/149676 – Conor Mancone Jul 19 at 16:34
  • In general it depends greatly on how they do it, but in all likelihood it's a losing battle. To not allow them to sniff everything you would have to use a device/browser that doesn't have the root certificate installed. That's actually quite easy, with a hundred different methods that allow you to easily circumvent the root certificate. However, they could just as easily block any and all https traffic that doesn't funnel through their systems. In that case you can't do anything, except hope to find a proxy that isn't blocked. – Conor Mancone Jul 19 at 16:38
  • Firefox will warn you every time you turn it on that you are possibly a victim of MITM attack. – Gravemind Jul 19 at 17:06
  • You can still encrypt data, but it will have to be in addition to the encryption done by HTTPS. Chances are very, very likely that it would be noticed and you'd have someone knocking on your door asking you what's up. In addition, it's always possible to do steganography in such a scenario, e.g. maybe encode something in what appears to be a JWT token, but that would take technical sophistication well beyond the average user. – Swashbuckler Jul 19 at 17:44
  • How are they enforcing this? – Andrew Jul 22 at 8:37
-1

“Anyone who controls the root CA knows everything you send through HTTPS, including your login passwords.”

This is not true.

First, note that what you are saying implies that Verisign (for example) can read your login passwords, credit card details, etc. That is quite obviously not the case.

If you trust me as a root CA, that means that your browser will trust any certificate signed by me.

Let us suppose that I am intercepting every packet sent to and from your browser, and you visit https://google.com.

  1. If your browser receives a certificate signed by the usual root CA used by Google - or by any root CA other than me - then your communications are totally secure. I cannot read or alter anything.

  2. If your browser receives a “google.com” certificate signed by me, then and only then, it is possible for me to read your transmissions and even alter them if I want.

Your browser will tell you which root CA is being used if you ask it (at least, desktop browsers will). So you will be able to know, whenever you want, whether 1 or 2 is the case.

To summarize: installation is not use. Installing a root CA does not make anything interceptable. Only using a certificate signed by that CA makes your security dependent on that CA’s policies. And (with appropriate browser support) you can always know when you are being intercepted.

  • 5
    While technically true, I don't think this answer is very helpful. Yes, you have to have install a root cert and be a MitM to read all traffic, so the quote from the OP is technically incorrect. However, the state has announced its desire to monitor all traffic, it has its own cert so that it can intercept all traffic, and it has ordered all ISPs to require the cert for everyone, force them to install it, and then to monitor all traffic. So while it's true that the cert's presence is not an issue if unused, I think it's safe to assume that it will be used in this case – Conor Mancone Jul 22 at 14:22
-4

First: if the state requires everyone to have a state-controlled root certificate installed, and it's a law, then being a good citizen requires following the law.

Second: The question you're asking becomes a question of legality. This is not something that can be reasonably answered with technology, because the laws of an area govern the technology that can or can't be used.

These both being the case, I agree that technological solutions are only going to cause trouble for you, because clearly the government believes that nobody would ever be able to breach their security and steal the very information they're claiming to protect. While governmental breaches happen on a more-or-less daily basis (chiefly, because policy-makers don't actually ask computer experts to explain how things work and understand why they must necessarily work that way), their intent to snoop is obvious, but ultimately will become self-defeating.

The answer, therefore, is to be a good citizen, and patiently obey the law, until such time as the security breaches make it clear that the government can't handle being the only CA for the entire country.

  • I have a few doubts. Such law would definitely breach the constitution of any modern state (as every constitution at some extent assures privacy of personal life) + it is against common sense. Governments should not put their noses in your data or we very fast will appear in George Orwell’s 1984. Also, if tomorrow there will be a law that every citizen should have the same Facebook/Google/whatsoever password, will you change it? – Gravemind Jul 20 at 4:23
  • While I don't disagree with you on any particular point, most governments in the past few years have seemingly justified ways around privacy for the sake of pursuing their own interests, and so my answer remains as it is. We can't idealize the situation, but must accept things as they are, in order to answer this. Orwell's story isn't the case yet, but it's closer today than even one decade ago. – JediGanesh Jul 22 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.