Kazakhstan has forced all users in its territory to install a state-issued SSL root CA certificate "aimed at enhancing the protection of citizens, government bodies and private companies from hacker attacks, Internet fraudsters and other types of cyber threats."1

The consequences is pretty straightforward: Anyone who controls the root CA knows everything you send through HTTPS, including your login passwords (provided the website relies on TLS-encrypted connections), your submitted forms and your credit cards.

In this case, is it still possible to send anything to a website, without any 3rd-party being able to intercept the connection and any data transmitted? Is there any way to avoid this MITM, or mitigate its impact?

  • 1
    Not an exact duplicate but you may be interested in this: security.stackexchange.com/q/194353/149676 – Conor Mancone Jul 19 '19 at 16:34
  • In general it depends greatly on how they do it, but in all likelihood it's a losing battle. To not allow them to sniff everything you would have to use a device/browser that doesn't have the root certificate installed. That's actually quite easy, with a hundred different methods that allow you to easily circumvent the root certificate. However, they could just as easily block any and all https traffic that doesn't funnel through their systems. In that case you can't do anything, except hope to find a proxy that isn't blocked. – Conor Mancone Jul 19 '19 at 16:38
  • Firefox will warn you every time you turn it on that you are possibly a victim of MITM attack. – Gravemind Jul 19 '19 at 17:06
  • You can still encrypt data, but it will have to be in addition to the encryption done by HTTPS. Chances are very, very likely that it would be noticed and you'd have someone knocking on your door asking you what's up. In addition, it's always possible to do steganography in such a scenario, e.g. maybe encode something in what appears to be a JWT token, but that would take technical sophistication well beyond the average user. – Swashbuckler Jul 19 '19 at 17:44
  • How are they enforcing this? – Andrew Jul 22 '19 at 8:37

I think the best option is tunneling your HTTPS traffic to a device that resides outside of Kazakhstan using an application that pins certificates. You would need a way to obtain the certificate of the device, this could be done by

  1. you leaving the country, allowing you to use devices out of the reach of the government
  2. getting help from a non-kazakh citizen that delivers certificate information to you in a secure manner (e.g. by writing down its fingerprint and physically giving it to you or using secure messengers such as WhatsApp or Signal)
| improve this answer | |

What is the sense of certificates?
It is to enable trust. Imagine you're surfing the website example.com. You trust in the fact that https://example.com is the identity that it claims to be, and that your communication with that server is safe from wiretapping. The CA chosen by example.com to sign their certificate signing request is usually (ideally?) a highly trusted organization that built their reputation over years, so that they made it into the out-of-the-box CA list of the browsers.
When a party creates their own certificate for example.com, and signs it with their own CA in order to be man in the middle then this is a malicious act (especially when this is by force and especially when it's a state), because they erode the trust that a certificate authority should responsibly respect and they're undermining the civil liberties of the people that they represent.
Usually these kinds of governments are called totalitarian regimes. See https://en.wikipedia.org/wiki/Human_rights_in_Kazakhstan

What can you do in technical terms?
- use an open socks proxy (NordVPN and similar; connect to it through SSH, and then configure your browser to use that proxy. )
- use a TOR browser with a TOR proxy to connect to the web

| improve this answer | |

“Anyone who controls the root CA knows everything you send through HTTPS, including your login passwords.”

This is not true.

First, note that what you are saying implies that Verisign (for example) can read your login passwords, credit card details, etc. That is quite obviously not the case.

If you trust me as a root CA, that means that your browser will trust any certificate signed by me.

Let us suppose that I am intercepting every packet sent to and from your browser, and you visit https://google.com.

  1. If your browser receives a certificate signed by the usual root CA used by Google - or by any root CA other than me - then your communications are totally secure. I cannot read or alter anything.

  2. If your browser receives a “google.com” certificate signed by me, then and only then, it is possible for me to read your transmissions and even alter them if I want.

Your browser will tell you which root CA is being used if you ask it (at least, desktop browsers will). So you will be able to know, whenever you want, whether 1 or 2 is the case.

To summarize: installation is not use. Installing a root CA does not make anything interceptable. Only using a certificate signed by that CA makes your security dependent on that CA’s policies. And (with appropriate browser support) you can always know when you are being intercepted.

| improve this answer | |
  • 7
    While technically true, I don't think this answer is very helpful. Yes, you have to have install a root cert and be a MitM to read all traffic, so the quote from the OP is technically incorrect. However, the state has announced its desire to monitor all traffic, it has its own cert so that it can intercept all traffic, and it has ordered all ISPs to require the cert for everyone, force them to install it, and then to monitor all traffic. So while it's true that the cert's presence is not an issue if unused, I think it's safe to assume that it will be used in this case – Conor Mancone Jul 22 '19 at 14:22

First: if the state requires everyone to have a state-controlled root certificate installed, and it's a law, then being a good citizen requires following the law.

Second: The question you're asking becomes a question of legality. This is not something that can be reasonably answered with technology, because the laws of an area govern the technology that can or can't be used.

These both being the case, I agree that technological solutions are only going to cause trouble for you, because clearly the government believes that nobody would ever be able to breach their security and steal the very information they're claiming to protect. While governmental breaches happen on a more-or-less daily basis (chiefly, because policy-makers don't actually ask computer experts to explain how things work and understand why they must necessarily work that way), their intent to snoop is obvious, but ultimately will become self-defeating.

The answer, therefore, is to be a good citizen, and patiently obey the law, until such time as the security breaches make it clear that the government can't handle being the only CA for the entire country.

| improve this answer | |
  • I have a few doubts. Such law would definitely breach the constitution of any modern state (as every constitution at some extent assures privacy of personal life) + it is against common sense. Governments should not put their noses in your data or we very fast will appear in George Orwell’s 1984. Also, if tomorrow there will be a law that every citizen should have the same Facebook/Google/whatsoever password, will you change it? – Gravemind Jul 20 '19 at 4:23
  • While I don't disagree with you on any particular point, most governments in the past few years have seemingly justified ways around privacy for the sake of pursuing their own interests, and so my answer remains as it is. We can't idealize the situation, but must accept things as they are, in order to answer this. Orwell's story isn't the case yet, but it's closer today than even one decade ago. – JediGanesh Jul 22 '19 at 18:19
  • You actually do not have to accept things as they are. You only have to accept consequences of your actions. Arguably, your whole standpoint is very questionable and your arguments come mostly from authority: Entity X has authority, so you have to follow that authority, whether you like that or not. – D.O. Dec 18 '19 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.