Finally VPNs will soon be illegal (in the UK, maybe)

[Pulsar]

I am entirely unsure why people are upset about this.

Party stores like 7-11 are not allowed to display pornagraphic magazines in plain sight, and cannot sell them to the underaged.

Why, exactly, should the internet pornography industry be any different?

In fact, it's far easier for children to turn on the computer than it is for them to walk down to the local liquor store.

 

[Acanthus]

I am entirely unsure why people are upset about this.

Party stores like 7-11 are not allowed to display pornagraphic magazines in plain sight, and cannot sell them to the underaged.

Why, exactly, should the internet pornography industry be any different?

In fact, it's far easier for children to turn on the computer than it is for them to walk down to the local liquor store.

Because VPNs are privacy tools, not pornography websites?

Until they pull a China and start throttling all SSL in and out of the country, the SSTP and OpenVPN based services are safe.

 

[GagHalfrunt]

I am entirely unsure why people are upset about this.

Because it's not lawmakers jobs to be parents. If parents don't want their kids viewing porn there are numerous ways to secure THEIR computers. Why should people of legal age have to jump through hoops to protect somebody else's kids if the parents are unwilling to do it? You kids, your responsibility. Period.

 

[Acanthus]

Even barring that, SSL is easy to man-in-the-middle. All the country has to do is mandate that their own root certificate is installed in all browsers and operating systems, and then they can inspect your SSL traffic without you being the wiser (no browser warnings indicating the cert isn't trusted, etc.) At that point, they'll be able to see your VPN that's encapsulated inside SSL. The way this works is that a device between your computer and the server intercepts the SSL traffic, decrypts it, and then reencrypts it with its own certificate. If its own certificate is trusted by your system, you will not receive a warning. Companies do this all the time, and it's fairly trivial to set up.

So, no, it's not difficult to get around.

Your "man in the middle" process is wrong. It assumes that they can decrypt the data and read it because they use a root CA they distributed. The data would not be encrypted using their root CA, it would be encrypted using the CA of the VPN service, which is unknown.

Much like the NSA, they could intercept the data, store it, and retransmit it without either party knowing, but if it is properly encrypted, it cannot be read.

Source: I run 16 VPN servers.

 

[WelshBloke]

Because it's not lawmakers jobs to be parents. If parents don't want their kids viewing porn there are numerous ways to secure THEIR computers. Why should people of legal age have to jump through hoops to protect somebody else's kids if the parents are unwilling to do it? You kids, your responsibility. Period.

Jump through hoops?

Sign up for Internet, tick "do not enable filters" box.

 

[drebo]

Your "man in the middle" process is wrong. It assumes that they can decrypt the data and read it because they use a root CA they distributed. The data would not be encrypted using their root CA, it would be encrypted using the CA of the VPN service, which is unknown.

Much like the NSA, they could intercept the data, store it, and retransmit it without either party knowing, but if it is properly encrypted, it cannot be read.

Source: I run 16 VPN servers.

For SSL/TLS, the public key/private key infrastructure is trivial to place a man in the middle. All you need is a device capable of inspecting the initial handshake and bam, you're done.

Several firewall vendors (for instance, Palo Alto) already have devices that can do it at line speed.

The point of the root cert is for the benefit of the client and has nothing to do with decrypting the data from the server.

 

[Acanthus]

For SSL/TLS, the public key/private key infrastructure is trivial to place a man in the middle. All you need is a device capable of inspecting the initial handshake and bam, you're done.

Several firewall vendors (for instance, Palo Alto) already have devices that can do it at line speed.

The point of the root cert is for the benefit of the client and has nothing to do with decrypting the data from the server.

So you are suggesting that DH, RSA, and ECDH handshakes can be trivially broken? Because it takes supercomputers months to break a 512-bit key... let alone a full 2048 bit.

Or are we just talking about X509 signed certificates?

 

[Lithium381]

So you are suggesting that DH, RSA, and ECDH handshakes can be trivially broken? Because it takes supercomputers months to break a 512-bit key... let alone a full 2048 bit.

Or are we just talking about X509 signed certificates?

the firewall acts as a full proxy and makes the outside connection on behalf of the computer. the computer is presented with a "trusted" cert from the fw and doesn't give half of a fsck where it came from if the company has installed a cert that the computer is told to 'trust'.

 

[Acanthus]

the firewall acts as a full proxy and makes the outside connection on behalf of the computer. the computer is presented with a "trusted" cert from the fw and doesn't give half of a fsck where it came from if the company has installed a cert that the computer is told to 'trust'.

if the company has installed a cert that the computer is told to 'trust'.

 

[Venix]

Your "man in the middle" process is wrong. It assumes that they can decrypt the data and read it because they use a root CA they distributed. The data would not be encrypted using their root CA, it would be encrypted using the CA of the VPN service, which is unknown.

No, he's correct. The process works like this:

1) You attempt to connect to a.com
2) Attacker intercepts your connection and prevents it from reaching a.com
3) Attacker pretends to be a.com by creating a fake a.com certificate
4) Since the attacker is a trusted CA on your computer, the certificate appears to be valid
5) Attacker makes his own connection to a.com
6) You think you're talking directly to a.com, but you're actually talking to the attacker, who then forwards the data to a.com after inspecting it

You could still detect this by checking the certificate chain, but most people wouldn't know how. And if this were implemented by a law, it would be public knowledge anyway.

 

[Acanthus]

No, he's correct. The process works like this:

1) You attempt to connect to a.com
2) Attacker intercepts your connection and prevents it from reaching a.com
3) Attacker pretends to be a.com by creating a fake a.com certificate
4) Since the attacker is a trusted CA on your computer, the certificate appears to be valid
5) Attacker makes his own connection to a.com
6) You think you're talking directly to a.com, but you're actually talking to the attacker, who then forwards the data to a.com after inspecting it

You could still detect this by checking the certificate chain, but most people wouldn't know how. And if this were implemented by a law, it would be public knowledge anyway.

where does the attacker get the fake signed certificate? You're also assuming the client is not using a secure DNS or the attacker is on a LAN with the client (or resides at the ISP itself) to be able to intercept the traffic. The client may not be using DNS at all, but a direct IP, to get around that you would need ARP poisoning, which is essentially LAN access. Not to mention with OpenVPN you have the HMAC firewall to deal with.

It is not nearly as simple as "you just hack em, lol"

You guys are pulling an underpants gnomes list here.

 

[Venix]

where does the attacker get the fake signed certificate?

As I said, it creates it. Can you elaborate on your confusion about this?

This isn't some unsubstantiated theory. Plenty of routers and parental control products (e.g. Net Nanny) filter HTTPS traffic this way.

 

[Acanthus]

As I said, it creates it. Can you elaborate on your confusion about this?

This isn't some unsubstantiated theory. Plenty of routers and parental control products (e.g. Net Nanny) filter HTTPS traffic this way.

This means the certificate is already installed on the client.... It isn't creating a new trusted certificate pretending to be a website because it doesnt have access to that websites root CA.

All your process is doing is installing software on the client that accepts CAs created by the "net nanny" it is not generating a certificate that impersonates another site.

I think where we are diverging is assuming that the attackers CA is installed on the client.

 

[Lifted]

As I said, it creates it. Can you elaborate on your confusion about this?

I'm more interested in you elaborating on how they "create it".

Unless the attacker has somehow compromised a trusted CA or the target computer, I don't see how "create it" is going to work.

 

[Venix]

I'm more interested in you elaborating on how they "create it".

Unless the attacker has somehow compromised a trusted CA or the target computer, I don't see how "create it" is going to work.

The conversation has assumed from the beginning that the attacker (the government) has installed a trusted certificate authority on the client computer.

From the first post about the topic: "All the country has to do is mandate that their own root certificate is installed in all browsers and operating systems"

From my previous post: "Since the attacker is a trusted CA on your computer"

 

[Lifted]

From my previous post: "Since the attacker is a trusted CA on your computer"

Gotcha. Didn't notice that.

 

[Acanthus]

Alright, it seems that we just had a fundamental misunderstanding on what we were talking about.

I was specifically referring to VPNs, and the MITM attack that involves actually compromising a cert to impersonate a server or a website.

The example you gave works if the attacker has a trusted CA on the client. I misunderstood what you were saying, and was referring specifically to the context of VPNs because that was what the OP was about.

However, getting a trusted CA on the client is the hard part. Even if the government mandates it, there will be open-source browsers and patches to simply remove / block / install other software to go around it.

If there was a foolproof way around X509, China would be all over it.

 

[Lifted]

No doubt sites, browsers, and browser add-ons would find a way to verify the cert and alert the user if the fingerprint doesn't match. This could be as simple as storing the fingerprint in a file at the sites root, or in the header of every html page, and the browser/add-on would verify the cert against it.

 

[Venix]

Alright, it seems that we just had a fundamental misunderstanding on what we were talking about.

I was specifically referring to VPNs, and the MITM attack that involves actually compromising a cert to impersonate a server or a website.

The example you gave works if the attacker has a trusted CA on the client. I misunderstood what you were saying, and was referring specifically to the context of VPNs because that was what the OP was about.

However, getting a trusted CA on the client is the hard part. Even if the government mandates it, there will be open-source browsers and patches to simply remove / block / install other software to go around it.

If there was a foolproof way around X509, China would be all over it.

Yep, that clears things up.

I agree on the huge caveats of mandating something like that. I could only see it sort-of working if it were paired with total surveillance of all data and severe criminal penalties for noncompliance. Even then, there are a ton of workarounds for truly committed people.

 

[Veliko]

Why the fuck do I care about UK laws? Everyone knows they don't have freedom of speech so they can censor whatever they want. This won't happen, fortunately, in the US.

Why do you assume that anyone cares whether you care about UK laws or not?

 

[Soundmanred]

I am old enough to be your father my son.

I'm 8 years old than you, damn near 40.

 

[Red Squirrel]

Wow, I could see this happen in the US, but sad to see the UK is becoming like the US when it comes to this stuff.

I like how they use porn as a "for the children" excuse, but we all know it's because they don't like the fact that VPNs make it harder to spy on people.

 

[CPA]

Why do you assume that anyone cares whether you care about UK laws or not?

Why do you assume anyone cares about whether you care about whether I care about UK laws or not?

Oh, that's right, it's a forum. No one has to care. Jeez Louise.

 

[BrightCandle]

The UK had free speech once, my parents told me about it. Now we can't protest without a licence, they even arrest groups discussing protests before they go out and do it. The press is fleeced at the airport and hard drives of journalists destroyed for telling us about illegal actions by our government against the populace. This problem is small biscuit compared to the overriding rights violations occurring in this once democratic country.

Less than 50% of people even vote now, we all mostly know its a scam (elections, voting, protesting, talking to our representatives) but some still hold out a dream the UK might one day again in the future become a democracy. Alas this might be my last message, they do after all monitor all communication and I might just be detained and tortured under terrorist laws. Frankly child porn and internet filtering aren't high on my list of atrocities a police state is enacting!

 

[ImpulsE69]

The only things that are a danger to children are politicians.....

...and Justin Beiber.