Hacker News Reader

Comment by jstanley | Hacker News Reader

But LinkedIn uses SSL. There's no mention of how GCHQ got around this. Does anyone know?

EDIT: Because the ability to MITM SSL sessions is a lot more scary to me than the willingness to MITM non-SSL sessions.

LinkedIn does not require (or automatically redirect to) SSL. If you're not logged in, the homepage is served over https://. If you are logged in, typing linkedin.com brings you to your news feed, no redirect to https://. If you aren't logged in, then enter your username and password, you're redirected from the https:// site to the http:// one.

I strongly suggest using httpseverywhere for this reason. Although for some reason linkedin.com is listed as "buggy" by default :/ so enabling it might break some stuff.

Linkedin actually didn't work for me with httpseverywhere - I had to exclude it for that site...

Works in Chrome now, at least.

Just tried it again, and yes, the main page works, but things like profile page and viewing the list of people who have recently viewed your profile give me blank pages.

If I disable it again, those pages work again...

Strange. Works fine here.

Well since the GCHQ is part of the government, and the government has a root cert in the browsers, they can basically create all the SSL certificates they want.

Governments can MITM without any problems.

I don't believe the UK gov have a TLS CA in any standard browser deployments do they? I'm not even sure we have a CA HQd here for them to compel into giving them certs for mitm?

Out of curiosity I had a quick scan through the "Trusted Root Certification Authorities" on this Windows 7 box and it's quite a surprising list - I have no idea who a lot of these organizations are...

Also, one thing I'm pretty confident about, is that if GCHQ is behind any of these certs they wouldn't go labeling it as "UK Government - GCHQ". So presumably I'm just trusting Microsoft that when these certs get pushed out as part of Windows they are who they say they are...

CA's can issue or lose intermediate certificates that they shouldn't. These have been detected at least 3 times when these technically valid but never before seen certificate chains are used for google.com/yahoo.com/microsoft.com etc.

http://googleonlinesecurity.blogspot.com.au/2013/01/enhancin... https://blog.torproject.org/blog/detecting-certificate-autho... http://www.chromium.org/Home/chromium-security/root-ca-polic...

http://www.mozilla.org/en-US/about/governance/policies/secur... lists those that firefox currently trusts.

How many of them are not amenable to some government somewhere? 0.

And how many would GCHQ have to compromise to get deniable MITM? 1.

Governments don't outright operate CAs, but given the long list of trusted authorities and intermediates in every modern browser, and given the various successes of these agencies, it seems a probable certainty that if they need to generate a trusted cert for given targets, they can. In effect I am agreeing.

The Apple SSL bug seemed overblown (from a government perspective) for that reason, and unlikely to be a government effort. Exploiting a CA seems significantly easier than embedding bugs in specific platforms. I suppose they might do both, but I doubt their abilities were reduced after it was patched.

LinkedIn doesn't use HSTS and can be sslstrip-ed. Even then, it's not like GCHQ would have qualms at using a spoofed cert (cert pinning could prevent this but isn't widely deployed), the express purpose of spooks is to use illegal methods.

Reply on news.ycombinator.com