Apple shifts iTunes to HTTPS, sidesteps China’s censors | Hacker News Reader

Apple shifts iTunes to HTTPS, sidesteps China’s censors

theregister.co.uk

51 pointsiProject22 comments

This seems to assume that the certificate chain in the software available within China is not compromised (aka, "obvious" way to detect MITM).

I honestly don't know if this is a fair assumption or not, it just strikes me as weird that it is not mentioned when first mentioning the "great firewall"

I suppose they could be using cert pinning[1].

[1]: http://www.imperialviolet.org/2011/05/04/pinning.html

Absolutely.

I wish they would address the topic, though. I interpret this article as if they mean that HTTPS solves all censoring and content sensing issues, regardless.

You mean Apple? In that case, I don't understand how that would help. The user never sees Apple's certificate, they only see the one presented by the MITM, no?

In this case, if understand the concept correctly, it would be iTunes that pins the certificate authority for the iTunes server.

One would still be vulnerable of a corrupt CA. The only solution to this would be to issue all certificates from an internal CA and verify this in your application.

Or you could just harcode the certificate fingerprint and refuse to accept anything else. It's trivial when you own the client.

I'm not sure if this would break when you needed to renew the certificate, but I guess you only update the signature, not the actual public key.

But if China is already MITM, they can modify or replace the binary while you are downloading it.

Yep. In that case, you don't own the client.

When you ship your own browser and OS you can prob get away with that.

Bad news: apparently China does have compromised certificates:

http://www.reddit.com/r/darknetplan/comments/156pyf/chinas_r...

I wonder if China will ever have a revolution, and if the "winners" will even want to revert to a "normal" Internet. The problem is most Chinese don't even know what that is.

>I wonder if China will ever have a revolution

I think, personally, that the Chinese government will just get more democratic over time. It's worth noting that China is certainly moreso now than it was a few decades ago.

The People's Republic of China is more liberal now than a few decades ago, but not more democratic. The leaders are still not elected by the people.

China has a CA. But so do lots of small Latin American countries. It'd be silly to think that a government the size of China cannot compromise some little country's CA. It'd also be silly to think that they cannot get inside at least one US CA. Comodo has shown that their controls are lacking, and that wasn't even a directly compromised employee.

So, China having a CA installed, while not great, certainly isn't giving them control they can't already get. Plus, why would they want to risk their own CA cert doing malicious things, where it'd be directly traceable to them?

I've got a question for security experts. I've always assumed that government should have enough cpu-power to decode a few encrypted emails and some https connection. So why don't China decode https traffics and perform the same filter as for simple tcp connection? And even tough they wouldn't have enough power to do so, why don't they break down the https connection when it is established?

> I've always assumed that government should have enough cpu-power to decode a few encrypted emails and some https connection

It doesn't (that we know of), that's pretty much the point of encryption.

Read the excerpt from Schneier's book, presented here:

http://www.schneier.com/blog/archives/2009/09/the_doghouse_c...

> why don't they break down the https connection when it is established?

Apprently they do. Serveral Google domains port 443 were blocked, e.g. https://accounts.google.com so you can't use anything google related, especially Gmail.

Extremely strong 'military grade' encryption is commonplace nowadays. It doesn't matter whether what yo're encrypting is a casual email or the launch codes for a nuclear weapon, consumer grade encryption such as that in https is fine as long as it's configured and used correctly. The CPU power required to break it is greater than all the CPUs in the world put together running for millions of years.

The problem is that if a way can be found to disrupt the configuration, such as by compromising the certificate chain, then decrypting the message becomes trivially easy.

So reading such a message is usually either impossible, or simple.

> And even tough they wouldn't have enough power to do so, why don't they break down the https connection when it is established?

You have to understand the purpose of China's Great Firewall. A lot of techies think that it's an attempt at 1984-style total control of information. With this in mind, they see a vessel full of obvious leaks, and can't understand why China does things this way. Blocking any connection you can't spy on is a simple solution to these leaks that any techie could come up with, but China doesn't do it (in general). Why not?

It's because the Great Firewall is not intended to be an instrument of total information control. It's intended as an instrument of broad social influence. The Chinese government does not care if you can use ssh or SSL or whatever to bounce through a proxy in the USA to get to an article about the Tiananmen Square massacre. You want to put in effort to seek out that information, go wild. You don't even need to cover your tracks.

This information is out there. They can't stop it, and they know it, and they don't even try. The purpose of censorship is to shape conversation, not eliminate information. Anyone with a little determination can bypass the firewall and read about whatever censored stuff they're interested in. But the vast majority of people don't have a little determination for this stuff. They might hit a link or perform a search, but when it fails, they'll just move on. Thus, while they can't, don't, and don't even try to stop people from knowing about these things, they can and successfully do stop people in general from thinking about them, and guide their attention to other topics.

China doesn't care about a few people using crypto to bypass their censorship. China does care about attracting foreign business, and if travelers couldn't connect to their VPNs and secure web sites then there would be serious trouble with that.

According to my friend in China, the App Store is still too slow for him to update his applications. Apple really should build some CDNs in mainland China.

Someone must translate this.

Why public cloud is so difficult to build in China

http://www.pingwest.com/why-public-cloud-is-so-difficult-to-...

That's why most western companies don't have VPS, IDC or CDN in China.

Great article.. Setting up CDNs in China is extremely hard without government support and local business being lead investors.

This assumes that https traffic isn't being attacked by the GFW, which it is. But I don't know, the app store was down for me up until a few days ago, so maybe this is working.

Reply on news.ycombinator.com