Universal forced HTTPS backdoor in Kazakhstan

List overview All Threads
Download

newer

older

Що робить вас щасливими цього...

Re: [Wikimedia-l] "Not in the...

Yury Bulka

21 Jul 2019 21 Jul '19

12:36 p.m.

Show replies by thread

Thomas Townsend

21 Jul 21 Jul

8:09 p.m.

Yury What is the position of the Kazakhstan chapter on this? The Turnip On Sun, 21 Jul 2019 at 11:36, Yury Bulka <setthemfree(a)privacyrequired.com> wrote:

...

I'm sure many have heard about this: https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html Essentially, the government in Kazakhstan started forcing citizens into installing a root TLS certificate on their devices that would allow the government to intercept, decrypt and manipulate all HTTPS traffic. Without the centificate, it seems, citizens can't access HTTPS pages (at least on some ISPs). I think this has serious implications for Wikipedia & Wikimedia, as not only they would be easily able to see which articles people read, but also steal login credentials, depseudonymize people and even hijack admin accounts. Another danger is that if this effort by Kazakhstan will succeed, other governments may start doing the same. I wonder if WMF has any position on this yet? Best, Yury. _______________________________________________ Wikimedia-l mailing list, guidelines at: https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

Steinsplitter Wiki

22 Jul 22 Jul

1:33 p.m.

That's shocking...

...

> I think this has serious implications for Wikipedia & Wikimedia, as not > only they would be easily able to see which articles people read, but > also steal login credentials, depseudonymize people and even hijack > admin accounts.

Yes, they can de-crypt the traffic. Hopefully browser vendors will disallow the root certificate. IMHO there isn't much WP can do, expect showing a warning if somebody is trying to login from the country in question. --Steinsplitter ________________________________ Von: Wikimedia-l <wikimedia-l-bounces(a)lists.wikimedia.org> im Auftrag von Yury Bulka <setthemfree(a)privacyrequired.com> Gesendet: Sonntag, 21. Juli 2019 12:36 An: wikimedia-l(a)lists.wikimedia.org <wikimedia-l(a)lists.wikimedia.org> Betreff: [Wikimedia-l] Universal forced HTTPS backdoor in Kazakhstan I'm sure many have heard about this: https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html Essentially, the government in Kazakhstan started forcing citizens into installing a root TLS certificate on their devices that would allow the government to intercept, decrypt and manipulate all HTTPS traffic. Without the centificate, it seems, citizens can't access HTTPS pages (at least on some ISPs). I think this has serious implications for Wikipedia & Wikimedia, as not only they would be easily able to see which articles people read, but also steal login credentials, depseudonymize people and even hijack admin accounts. Another danger is that if this effort by Kazakhstan will succeed, other governments may start doing the same. I wonder if WMF has any position on this yet? Best, Yury. _______________________________________________ Wikimedia-l mailing list, guidelines at: https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

Yuri Astrakhan

2:35 p.m.

I don't think browser vendors will block the ability to install a custom root certificate because some corp clients may use it for exactly the same reason -- creating an HTTPS proxy with fake certs in order to analyze internal traffic (in the name of monitoring/security). Browser vendors could make it more difficult to install, so that it would require the corp IT department to do some magic, or even release two versions of the browser - corp and general (with blocked uncertified root certs), but at the end of the day those could be worked around. The biggest deterrent in my opinion is to educating the users of the dangers such certs would do (i.e. all your passwords and bank info will be viewable by ISPs) - thus it would be social rather than purely technical solution. On Mon, Jul 22, 2019 at 1:33 PM Steinsplitter Wiki < steinsplitter(a)wikipedia.de> wrote:

...

That's shocking...

George Herbert

7:05 p.m.

Browser vendors could revoke the root that Kazakh authorities are using for the scheme. On Mon, Jul 22, 2019 at 5:35 AM Yuri Astrakhan <yuriastrakhan(a)gmail.com> wrote:

...

That's shocking... >> I think this has serious implications for Wikipedia & Wikimedia, as

not

> only they would be easily able to see which articles people read, but > also steal login credentials, depseudonymize people and even hijack > admin accounts.

von

Yury Bulka <setthemfree(a)privacyrequired.com> Gesendet: Sonntag, 21. Juli 2019 12:36 An: wikimedia-l(a)lists.wikimedia.org <wikimedia-l(a)lists.wikimedia.org> Betreff: [Wikimedia-l] Universal forced HTTPS backdoor in Kazakhstan I'm sure many have heard about this:

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

Essentially, the government in Kazakhstan started forcing citizens into installing a root TLS certificate on their devices that would allow the government to intercept, decrypt and manipulate all HTTPS traffic. Without the centificate, it seems, citizens can't access HTTPS pages (at least on some ISPs). I think this has serious implications for Wikipedia & Wikimedia, as not only they would be easily able to see which articles people read, but also steal login credentials, depseudonymize people and even hijack admin accounts. Another danger is that if this effort by Kazakhstan will succeed, other governments may start doing the same. I wonder if WMF has any position on this yet? Best, Yury. _______________________________________________ Wikimedia-l mailing list, guidelines at: https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe> _______________________________________________ Wikimedia-l mailing list, guidelines at: https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

_______________________________________________ Wikimedia-l mailing list, guidelines at: https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

-- -george william herbert george.herbert(a)gmail.com

rupert THURNER

8:11 p.m.

displaying a warning that there is a MITM which reads all passwords and banking information sounds nice, yuri. there even seems to be ways to detect this client-server side: https://www.reddit.com/r/javascript/comments/7ldypq/is_it_possible_to_detec… - you mean something like this would do, yury? george, the trusted root certificates would be configurable, usually, like for chrome here: https://support.securly.com/hc/en-us/articles/206081828-How-to-manually-ins… companies pay money to get into this list, so they can easier sell their website certificates. closing down the list for sure leads to some anti-trust legal action in other countries. btw, recently there was a blog post from a developer in iran, saying the same : https://shahinsorkh.ir/2019/07/20/how-is-it-like-to-be-a-dev-in-iran this had an even more surprising aspect - not only would the country block access to some site - but sites itself decided to remove users having a relationship with that country: "Slack team, decided to join the sanctions. They simply deleted every single user who they found out is Iranian! With no real prior notices! Many people has lost their data on Slack and no one was going to do anything!" rupert On Mon, Jul 22, 2019 at 7:05 PM George Herbert <george.herbert(a)gmail.com> wrote:

...

Browser vendors could revoke the root that Kazakh authorities are using for the scheme. On Mon, Jul 22, 2019 at 5:35 AM Yuri Astrakhan <yuriastrakhan(a)gmail.com> wrote:

I don't think browser vendors will block the ability to install a custom root certificate because some corp clients may use it for exactly the

same

reason -- creating an HTTPS proxy with fake certs in order to analyze internal traffic (in the name of monitoring/security). Browser vendors could make it more difficult to install, so that it would require the corp IT department to do some magic, or even release two versions of the browser - corp and general (with blocked uncertified root certs), but at the end of the day those could be worked around. The biggest deterrent in my opinion is to educating the users of the dangers such certs would do (i.e. all your passwords and bank info will

viewable by ISPs) - thus it would be social rather than purely technical solution. On Mon, Jul 22, 2019 at 1:33 PM Steinsplitter Wiki < steinsplitter(a)wikipedia.de> wrote:

That's shocking... >> I think this has serious implications for Wikipedia & Wikimedia, as

not > >> only they would be easily able to see which articles people read,

but

> >> also steal login credentials, depseudonymize people and even hijack > >> admin accounts. > > Yes, they can de-crypt the traffic. Hopefully browser vendors will > disallow the root certificate. > IMHO there isn't much WP can do, expect showing a warning if somebody

trying to login from the country in question. --Steinsplitter ________________________________ Von: Wikimedia-l <wikimedia-l-bounces(a)lists.wikimedia.org> im Auftrag

von

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

> > Essentially, the government in Kazakhstan started forcing citizens into > installing a root TLS certificate on their devices that would allow the > government to intercept, decrypt and manipulate all HTTPS traffic. > > Without the centificate, it seems, citizens can't access HTTPS pages

(at

least on some ISPs). I think this has serious implications for Wikipedia & Wikimedia, as not only they would be easily able to see which articles people read, but also steal login credentials, depseudonymize people and even hijack admin accounts. Another danger is that if this effort by Kazakhstan will succeed, other governments may start doing the same. I wonder if WMF has any position on this yet? Best, Yury. _______________________________________________ Wikimedia-l mailing list, guidelines at: https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe> _______________________________________________ Wikimedia-l mailing list, guidelines at: https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

-- -george william herbert george.herbert(a)gmail.com _______________________________________________ Wikimedia-l mailing list, guidelines at: https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

Yury Bulka

23 Jul 23 Jul

11:49 a.m.

Honestly, I am not sure what actions would be appropriate. My initial reaction was - Wikipedia (and all Wikimedia sites) is HTTPS-only, and this undermines HTTPS as such. So if Wikipedia should only be accessible over (real, no man-in-the-middle) HTTPS, perhaps requests that don't meet this criteria should not be allowed. (Maybe a landing page displayed explaining the security implications). Another thought that poped up in my mind was to make it read-only over unsecure connections. I'm not very familiar with the circumstances of the 2015 decision to move to mandatory HTTPS and if that implied being blocked or inaccessible in whole countries as a consequence of this policy. But if that was the case, Kazakhstan perhaps falls into a similar category? The technical difference (no HTTPS vs a HTTPS only if users allow government man-in-the-middle) is just a technical detail in my opinion, as the effects are the same as if Wikipedia was made only accessible over unencrypted HTTP in Kazakhstan. Showing warnings is of course an option, but I am not sure if this is an effective security measure if users are forced by the goverment to install a backdoor. Maybe it's better if Wikipedia would only be accessible over VPN or Tor if direct HTTPS is undermined this way. This would of course only work if users can have a secure connection to a VPN... Hopefully, browsers do blacklist the certificate. And hopefully, they will not start a cat-and-mouse game by rotating their certificate... rupert THURNER <rupert.thurner(a)gmail.com> writes:

...

Browser vendors could revoke the root that Kazakh authorities are using for the scheme. On Mon, Jul 22, 2019 at 5:35 AM Yuri Astrakhan <yuriastrakhan(a)gmail.com> wrote:

I don't think browser vendors will block the ability to install a custom root certificate because some corp clients may use it for exactly the

same

viewable by ISPs) - thus it would be social rather than purely technical solution. On Mon, Jul 22, 2019 at 1:33 PM Steinsplitter Wiki < steinsplitter(a)wikipedia.de> wrote:

That's shocking... >> I think this has serious implications for Wikipedia & Wikimedia, as

not > >> only they would be easily able to see which articles people read,

but

trying to login from the country in question. --Steinsplitter ________________________________ Von: Wikimedia-l <wikimedia-l-bounces(a)lists.wikimedia.org> im Auftrag

von

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

(at

Yaroslav Blanter

1:40 p.m.

I do not think Kazakhstan has a chapter. In the past, some Kazakh Wikimedians enjoyed close collaboration with the government (for example, the Kazakhstani Encyclopedia has been released under a free license and verbatim copied to the Kazakh Wikipedia, so that I do not expect much. Cheers Yaroslav On Tue, Jul 23, 2019 at 12:45 PM Thomas Townsend <homesec1783(a)gmail.com> wrote:

...

Yury What is the position of the Kazakhstan chapter on this? The Turnip On Sun, 21 Jul 2019 at 11:36, Yury Bulka <setthemfree(a)privacyrequired.com> wrote:

I'm sure many have heard about this:

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l

New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

<mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe> _______________________________________________ Wikimedia-l mailing list, guidelines at: https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

Yury Bulka

2:42 p.m.

I'm not in Kazakhstan and am not in directly touch with any of wikimedians there, so I don't know their position. However, I'm not sure how much freedom they have in expressing their honest opinion about this publicly. Simply because it is always a pros-and-cons calculation to criticise your local goverment in such situations. Yaroslav Blanter <ymbalt(a)gmail.com> writes:

...

Yury What is the position of the Kazakhstan chapter on this? The Turnip On Sun, 21 Jul 2019 at 11:36, Yury Bulka <setthemfree(a)privacyrequired.com> wrote:

I'm sure many have heard about this:

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l

New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

Yury Bulka

26 Jul 26 Jul

3:04 p.m.

I don't see any position from Mozilla on this yet: https://bugzilla.mozilla.org/show_bug.cgi?id=1567114 https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/wnuKAhA… Couldn't find anything about Google Chrome. Meanwhile, I have emailed security(a)wikimedia.org with a link to this discussion (hope it's not a terribly inappropriate thing to do). I'd be great to hear from WMF about their view on this. Best, Yury. Yury Bulka <setthemfree(a)privacyrequired.com> writes:

...

Yury What is the position of the Kazakhstan chapter on this? The Turnip On Sun, 21 Jul 2019 at 11:36, Yury Bulka <setthemfree(a)privacyrequired.com> wrote:

I'm sure many have heard about this:

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l

New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

John Erling Blad

28 Jul 28 Jul

1:58 p.m.

The Kazakhstan MITM could be stopped by HTTP Public Key Pinning [1], but Chrome seems to have dropped support for HPKP[2]? Dropping HPKP made the MITM attack possible, by forcing the users to install the root certificate, as many of the sites listed has been on the HPKP list. With HPKP in place the scheme would be somewhat harder to implement. [1] https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1412438 On Fri, Jul 26, 2019 at 3:05 PM Yury Bulka <setthemfree(a)privacyrequired.com> wrote:

...

example,

the Kazakhstani Encyclopedia has been released under a free license and verbatim copied to the Kazakh Wikipedia, so that I do not expect much. Cheers Yaroslav On Tue, Jul 23, 2019 at 12:45 PM Thomas Townsend <homesec1783(a)gmail.com

> wrote: > >> Yury >> >> What is the position of the Kazakhstan chapter on this? >> >> The Turnip >> >> On Sun, 21 Jul 2019 at 11:36, Yury Bulka >> <setthemfree(a)privacyrequired.com> wrote: >> > >> > I'm sure many have heard about this: >> > >>

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

>> > >> > Essentially, the government in Kazakhstan started forcing citizens

into

>> > installing a root TLS certificate on their devices that would allow

the

>> > government to intercept, decrypt and manipulate all HTTPS traffic. >> > >> > Without the centificate, it seems, citizens can't access HTTPS pages

(at

>> > least on some ISPs). >> > >> > I think this has serious implications for Wikipedia & Wikimedia, as

not

>> > only they would be easily able to see which articles people read, but >> > also steal login credentials, depseudonymize people and even hijack >> > admin accounts. >> > >> > Another danger is that if this effort by Kazakhstan will succeed,

other

>> > governments may start doing the same. >> > >> > I wonder if WMF has any position on this yet? >> > >> > Best, >> > Yury. >> > >> > _______________________________________________ >> > Wikimedia-l mailing list, guidelines at: >> https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and >> https://meta.wikimedia.org/wiki/Wikimedia-l >> > New messages to: Wikimedia-l(a)lists.wikimedia.org >> > Unsubscribe:

https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

>> <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe> >> >> _______________________________________________ >> Wikimedia-l mailing list, guidelines at: >> https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and >> https://meta.wikimedia.org/wiki/Wikimedia-l >> New messages to: Wikimedia-l(a)lists.wikimedia.org >> Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, >> <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe> > _______________________________________________ > Wikimedia-l mailing list, guidelines at:

https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l

> New messages to: Wikimedia-l(a)lists.wikimedia.org > Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

<mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

_______________________________________________ Wikimedia-l mailing list, guidelines at:

https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l

New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

Alex Monk

2:06 p.m.

Correct me if I'm wrong but I believe browsers always ignored HPKP rules when presented with a cert signed by a CA that is locally installed rather than default. On Sun, 28 Jul 2019, 12:58 John Erling Blad, <jeblad(a)gmail.com> wrote:

...

I don't see any position from Mozilla on this yet: https://bugzilla.mozilla.org/show_bug.cgi?id=1567114

https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/wnuKAhA…

example, >> the Kazakhstani Encyclopedia has been released under a free license

and

>> verbatim copied to the Kazakh Wikipedia, so that I do not expect much. >> >> Cheers >> Yaroslav >> >> On Tue, Jul 23, 2019 at 12:45 PM Thomas Townsend <

homesec1783(a)gmail.com

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

>> > >> > Essentially, the government in Kazakhstan started forcing citizens

into

>> > installing a root TLS certificate on their devices that would allow

the >>> > government to intercept, decrypt and manipulate all HTTPS traffic. >>> > >>> > Without the centificate, it seems, citizens can't access HTTPS

pages

(at

>> > least on some ISPs). >> > >> > I think this has serious implications for Wikipedia & Wikimedia, as

not >>> > only they would be easily able to see which articles people read,

but

>> > also steal login credentials, depseudonymize people and even hijack >> > admin accounts. >> > >> > Another danger is that if this effort by Kazakhstan will succeed,

other

https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, >>> <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe> >>> >>> _______________________________________________ >>> Wikimedia-l mailing list, guidelines at: >>> https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and >>> https://meta.wikimedia.org/wiki/Wikimedia-l >>> New messages to: Wikimedia-l(a)lists.wikimedia.org >>> Unsubscribe:

https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

>> <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe> > _______________________________________________ > Wikimedia-l mailing list, guidelines at:

https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l >> New messages to: Wikimedia-l(a)lists.wikimedia.org >> Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l

<mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

_______________________________________________ Wikimedia-l mailing list, guidelines at:

https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l

New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

Chico Venancio

2:12 p.m.

FYI, it seems Wikimedia is not being intercepted at the moment. https://censoredplanet.org/kazakhstan Of course, that may change. It may also be relevant that Wikimedia uses HSTS, and that will make it difficult for users to access the sites with intercepted certificates if they have accessed the sites previously. Chico Venancio Em dom, 28 de jul de 2019 08:58, John Erling Blad <jeblad(a)gmail.com> escreveu:

...

I don't see any position from Mozilla on this yet: https://bugzilla.mozilla.org/show_bug.cgi?id=1567114

https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/wnuKAhA…

example, >> the Kazakhstani Encyclopedia has been released under a free license

and

>> verbatim copied to the Kazakh Wikipedia, so that I do not expect much. >> >> Cheers >> Yaroslav >> >> On Tue, Jul 23, 2019 at 12:45 PM Thomas Townsend <

homesec1783(a)gmail.com

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

>> > >> > Essentially, the government in Kazakhstan started forcing citizens

into

>> > installing a root TLS certificate on their devices that would allow

the >>> > government to intercept, decrypt and manipulate all HTTPS traffic. >>> > >>> > Without the centificate, it seems, citizens can't access HTTPS

pages

(at

>> > least on some ISPs). >> > >> > I think this has serious implications for Wikipedia & Wikimedia, as

not >>> > only they would be easily able to see which articles people read,

but

>> > also steal login credentials, depseudonymize people and even hijack >> > admin accounts. >> > >> > Another danger is that if this effort by Kazakhstan will succeed,

other

https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

>> <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe> > _______________________________________________ > Wikimedia-l mailing list, guidelines at:

<mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

_______________________________________________ Wikimedia-l mailing list, guidelines at:

https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l

New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

John Erling Blad

2:43 p.m.

You are right. “Firefox and Chrome disable pin validation for pinned hosts whose validated certificate chain terminates at a user-defined trust anchor (rather than a built-in trust anchor). This means that for users who imported custom root certificates all pinning violations are ignored.” [1] [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning On Sun, Jul 28, 2019 at 2:07 PM Alex Monk <krenair(a)gmail.com> wrote:

...

certificate,

as many of the sites listed has been on the HPKP list. With HPKP in place the scheme would be somewhat harder to implement. [1] https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1412438 On Fri, Jul 26, 2019 at 3:05 PM Yury Bulka < setthemfree(a)privacyrequired.com> wrote:

I don't see any position from Mozilla on this yet: https://bugzilla.mozilla.org/show_bug.cgi?id=1567114

https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/wnuKAhA…

example, >> the Kazakhstani Encyclopedia has been released under a free license

and > >> verbatim copied to the Kazakh Wikipedia, so that I do not expect

much.

>> >> Cheers >> Yaroslav >> >> On Tue, Jul 23, 2019 at 12:45 PM Thomas Townsend <

homesec1783(a)gmail.com

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

> >>> > > >>> > Essentially, the government in Kazakhstan started forcing

citizens

> into > >>> > installing a root TLS certificate on their devices that would

allow

> the > >>> > government to intercept, decrypt and manipulate all HTTPS

traffic.

>>> > >>> > Without the centificate, it seems, citizens can't access HTTPS

pages > (at > >>> > least on some ISPs). > >>> > > >>> > I think this has serious implications for Wikipedia & Wikimedia,

not >>> > only they would be easily able to see which articles people read,

but > >>> > also steal login credentials, depseudonymize people and even

hijack

> >>> > admin accounts. > >>> > > >>> > Another danger is that if this effort by Kazakhstan will succeed, > other > >>> > governments may start doing the same. > >>> > > >>> > I wonder if WMF has any position on this yet? > >>> > > >>> > Best, > >>> > Yury. > >>> > > >>> > _______________________________________________ > >>> > Wikimedia-l mailing list, guidelines at: > >>> https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and > >>> https://meta.wikimedia.org/wiki/Wikimedia-l > >>> > New messages to: Wikimedia-l(a)lists.wikimedia.org > >>> > Unsubscribe: > https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, > >>> <mailto:wikimedia-l-request@lists.wikimedia.org

?subject=unsubscribe>

>>> >>> _______________________________________________ >>> Wikimedia-l mailing list, guidelines at: >>> https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and >>> https://meta.wikimedia.org/wiki/Wikimedia-l >>> New messages to: Wikimedia-l(a)lists.wikimedia.org >>> Unsubscribe:

https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, > >>> <mailto:wikimedia-l-request@lists.wikimedia.org

?subject=unsubscribe>

> >> _______________________________________________ > >> Wikimedia-l mailing list, guidelines at: > https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and > https://meta.wikimedia.org/wiki/Wikimedia-l > >> New messages to: Wikimedia-l(a)lists.wikimedia.org > >> Unsubscribe:

https://lists.wikimedia.org/mailman/listinfo/wikimedia-l

, > <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe> > > > > _______________________________________________ > > Wikimedia-l mailing list, guidelines at: > https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and > https://meta.wikimedia.org/wiki/Wikimedia-l > > New messages to: Wikimedia-l(a)lists.wikimedia.org > > Unsubscribe:

https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

John Erling Blad

4:21 p.m.

Seems like something happen early Friday morning.[1] [1] https://censoredplanet.org/kazakhstan/live On Sun, Jul 28, 2019 at 2:43 PM John Erling Blad <jeblad(a)gmail.com> wrote:

...

certificate,

as many of the sites listed has been on the HPKP list. With HPKP in

place

the scheme would be somewhat harder to implement. [1] https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1412438 On Fri, Jul 26, 2019 at 3:05 PM Yury Bulka < setthemfree(a)privacyrequired.com> wrote:

I don't see any position from Mozilla on this yet: https://bugzilla.mozilla.org/show_bug.cgi?id=1567114

https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/wnuKAhA…

Couldn't find anything about Google Chrome. Meanwhile, I have emailed security(a)wikimedia.org with a link to this discussion (hope it's not a terribly inappropriate thing to do). I'd be great to hear from WMF about their view on this. Best, Yury. Yury Bulka <setthemfree(a)privacyrequired.com> writes: > I'm not in Kazakhstan and am not in directly touch with any of > wikimedians there, so I don't know their position. > > However, I'm not sure how much freedom they have in expressing their > honest opinion about this publicly. Simply because it is always a > pros-and-cons calculation to criticise your local goverment in such > situations. > > Yaroslav Blanter <ymbalt(a)gmail.com> writes: > >> I do not think Kazakhstan has a chapter. In the past, some Kazakh >> Wikimedians enjoyed close collaboration with the government (for example, >> the Kazakhstani Encyclopedia has been released under a free license

and > >> verbatim copied to the Kazakh Wikipedia, so that I do not expect

much.

>> >> Cheers >> Yaroslav >> >> On Tue, Jul 23, 2019 at 12:45 PM Thomas Townsend <

homesec1783(a)gmail.com

> >> wrote: >> >>> Yury >>> >>> What is the position of the Kazakhstan chapter on this? >>> >>> The Turnip >>> >>> On Sun, 21 Jul 2019 at 11:36, Yury Bulka >>> <setthemfree(a)privacyrequired.com> wrote: >>> > >>> > I'm sure many have heard about this: >>> > >>>

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

> >>> > > >>> > Essentially, the government in Kazakhstan started forcing

citizens

> into > >>> > installing a root TLS certificate on their devices that would

allow

> the > >>> > government to intercept, decrypt and manipulate all HTTPS

traffic.

>>> > >>> > Without the centificate, it seems, citizens can't access HTTPS

pages > (at > >>> > least on some ISPs). > >>> > > >>> > I think this has serious implications for Wikipedia &

Wikimedia, as

> not > >>> > only they would be easily able to see which articles people

read,

but > >>> > also steal login credentials, depseudonymize people and even

hijack

> >>> > admin accounts. > >>> > > >>> > Another danger is that if this effort by Kazakhstan will

succeed,

> other > >>> > governments may start doing the same. > >>> > > >>> > I wonder if WMF has any position on this yet? > >>> > > >>> > Best, > >>> > Yury. > >>> > > >>> > _______________________________________________ > >>> > Wikimedia-l mailing list, guidelines at: > >>> https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and > >>> https://meta.wikimedia.org/wiki/Wikimedia-l > >>> > New messages to: Wikimedia-l(a)lists.wikimedia.org > >>> > Unsubscribe: > https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, > >>> <mailto:wikimedia-l-request@lists.wikimedia.org

?subject=unsubscribe>

https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, > >>> <mailto:wikimedia-l-request@lists.wikimedia.org

?subject=unsubscribe>

https://lists.wikimedia.org/mailman/listinfo/wikimedia-l

https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

> <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe> > > > _______________________________________________ > Wikimedia-l mailing list, guidelines at: > https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and > https://meta.wikimedia.org/wiki/Wikimedia-l > New messages to: Wikimedia-l(a)lists.wikimedia.org > Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l

<mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

Thomas Townsend

7:26 p.m.

Yaroslav If there is no local chapter willing and able to take action, then presumably it falls to WMF central to do so, as they have in the USA and Turkey The Turnip On Tue, 23 Jul 2019 at 12:41, Yaroslav Blanter <ymbalt(a)gmail.com> wrote:

...

Yury What is the position of the Kazakhstan chapter on this? The Turnip On Sun, 21 Jul 2019 at 11:36, Yury Bulka <setthemfree(a)privacyrequired.com> wrote:

I'm sure many have heard about this:

https://thehackernews.com/2019/07/kazakhstan-https-security-certificate.html

https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l

New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

John Erling Blad

23 Aug 23 Aug

11:15 a.m.

Google, Apple, Mozilla move to block Kazakh surveillance system https://www.reuters.com/article/us-kazakhstan-internet-surveillance/google-…

Yury Bulka

11:29 a.m.

I'm getting a 404:( John Erling Blad <jeblad(a)gmail.com> writes:

...

Google, Apple, Mozilla move to block Kazakh surveillance system https://www.reuters.com/article/us-kazakhstan-internet-surveillance/google-… _______________________________________________ Wikimedia-l mailing list, guidelines at: https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, <mailto:wikimedia-l-request@lists.wikimedia.org?subject=unsubscribe>

RhinosF1

12:36 p.m.

link works fine for me Yury On Fri, 23 Aug 2019 at 10:29, Yury Bulka <setthemfree(a)privacyrequired.com> wrote:

...

I'm getting a 404:( John Erling Blad <jeblad(a)gmail.com> writes:

Google, Apple, Mozilla move to block Kazakh surveillance system

https://www.reuters.com/article/us-kazakhstan-internet-surveillance/google-…

_______________________________________________ Wikimedia-l mailing list, guidelines at:

https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l

New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

Yury Bulka

26 Aug 26 Aug

11:45 p.m.

Hm, interesting - the page reports 404 if JS is disabled, but loads otherwise. Thanks for the hint. Also sharing Mozilla's statement: https://blog.mozilla.org/blog/2019/08/21/mozilla-takes-action-to-protect-us… Good to know. RhinosF1 <rhinosf1(a)gmail.com> writes:

...

link works fine for me Yury On Fri, 23 Aug 2019 at 10:29, Yury Bulka <setthemfree(a)privacyrequired.com> wrote:

I'm getting a 404:( John Erling Blad <jeblad(a)gmail.com> writes:

Google, Apple, Mozilla move to block Kazakh surveillance system

https://www.reuters.com/article/us-kazakhstan-internet-surveillance/google-…

_______________________________________________ Wikimedia-l mailing list, guidelines at:

https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines and https://meta.wikimedia.org/wiki/Wikimedia-l

New messages to: Wikimedia-l(a)lists.wikimedia.org Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,

1703

days inactive

1739

days old

wikimedia-l@lists.wikimedia.org

Manage subscription

19 comments

11 participants

tags (0)

participants (11)

Alex Monk
Chico Venancio
George Herbert
John Erling Blad
RhinosF1
rupert THURNER
Steinsplitter Wiki
Thomas Townsend
Yaroslav Blanter
Yuri Astrakhan
Yury Bulka