From tony.naggs at googlemail.com Fri Jun 1 11:39:45 2012 From: tony.naggs at googlemail.com (Tony Naggs) Date: Fri, 1 Jun 2012 11:39:45 +0100 Subject: Data collection in government In-Reply-To: References: Message-ID: There are companies offering tools & services for managing corporate mobile phones, logging such things as phone calls & text messages. These records can then be used as input for billing (e.g. for technical, legal or medical advice) or retained for compliance purposes, e.g. logging a stock trader's contacts with clients. On 31 May 2012 16:25, Ian Batten wrote: > Does any know what the source is for the logged copies of all the text > messages between Jeremy Hunt and assorted members of his circle? Is the > government logging all text messages from ministers, Spads and so on? > > ian > > > -------------- next part -------------- An HTML attachment was scrubbed... URL: From tugwilson at gmail.com Fri Jun 1 17:44:48 2012 From: tugwilson at gmail.com (John Wilson) Date: Fri, 1 Jun 2012 17:44:48 +0100 Subject: Data collection in government In-Reply-To: References: Message-ID: Apparently the texts were still on Hunt's phone http://www.guardian.co.uk/media/2012/jun/01/jeremy-hunt-texts-leveson John Wilson From ukcrypto at originalthinktank.org.uk Fri Jun 1 19:31:33 2012 From: ukcrypto at originalthinktank.org.uk (Chris Salter) Date: Fri, 01 Jun 2012 19:31:33 +0100 Subject: President Obama Ordered Stuxnet and More Attacks on Iran (June 1, 2012) Message-ID: <4FC90A85.3050805@originalthinktank.org.uk> --President Obama Ordered Stuxnet and More Attacks on Iran (June 1, 2012) (By Gautham Nagesh, CQ Executive Briefing on Technology) The New York Times has a bombshell this morning: President Obama began ordering cyberattacks on Iran within days of taking office. The story, which is a must-read, finally confirms what many cybersecurity experts have suspected: the Stuxnet worm, which disabled industrial equipment in Iran and Europe, was originally designed by Israel and the U.S. to slow down Iran's nuclear enrichment plant. The virus' escape from Iran's Natanz plant and subsequent discovery in Germany in 2010 was a mistake that U.S. authorities blamed on Israel. Former CIA chief Michael Hayden also acknowledged to the Times that Stuxnet is the first major cyberattack intended to cause physical destruction (to Iranian centrifuges). "Somebody crossed the Rubicon," he said. The article includes a history of the classified cyberweapons program, dubbed "Olympic Games," which began under President Bush, and includes details of how President Obama decided that digital attacks were preferable to a potential military conflict between Iran and Israel. But the bottom line is that President Obama (and his predecessor) ordered a sophisticated campaign of cyberattacks against Iran's nuclear program, and has either attacked or considered attacking networks in China, Syria, and North Korea as well. The Obama administration previously acknowledged that it might respond to cyberattacks with physical force, but the report makes it clear that even as the U.S. was making those threats, it was perpetrating cyberattacks on the very nations it accuses of targeting its networks. In doing so, the White House has seemingly opened a Pandora's box. Administration officials have placed a greater emphasis on cybersecurity and the threat to our nation's networks that any previous administration, doubtless because they had first-hand knowledge of just how much damage sophisticated cyberattacks are capable of causing. Those officials might have also feared reprisals from nations that were targeted by Stuxnet and other digital attacks from the U.S. The revelation also sheds some light on the Pentagon's reluctance to outline its cyberwarfare policies in detail, since doing so might have involved disclosing to Congress that the U.S. already was fully engaged in online battle. Having taken such an aggressive stance on deploying Stuxnet, it will be very difficult for the U.S. to keep casting itself as the innocent victim of unprovoked attacks by countries looking to steal our economic and military secrets. Today's report makes it clear that the White House long ago decided to embrace digital warfare, and puts the onus squarely back on the administration to clearly explain its rules of engagement online. But the greatest impact may be internationally, where hostile nations now have confirmation the U.S. could be targeting their networks. If hackers in those countries weren't already attempting to take down U.S. critical infrastructure, they probably are now. http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html?_r=1&pagewanted=all or http://preview.tinyurl.com/d9snhb9 The above is extracted from SANS NewsBites Vol. 14 Num. 44 (Newsletter) which also had the following preface: FLASH: The New York Times reported this morning that President Obama (and his predecessor) ordered a sophisticated campaign of cyberattacks against Iran's nuclear program, and has either attacked or considered attacking networks in China, Syria, and North Korea as well. Because the publication of this story is likely to herald substantive and far-ranging changes in the way cybersecurity is managed in the US and in many other countries, we have included an analysis by Gautham Nagesh. Under normal circumstances, his thoughtful, in-depth analyses are available only to paid subscribers to CQ Roll Call "Executive Briefing on Technology." This is an abnormal circumstance. There is great value in the security community understanding that the game has changed, and what it means. Alan PS Another very valuable piece of cybersecurity reporting will appear on the front page of the Washington Post on Sunday or Monday and then be discussed on National Public Radio (the Diane Rehm show) on Monday morning. +++++ Please feel free to share this [newsletter] with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit http://portal.sans.org/ -- Chris Salter http://www.originalthinktank.org.uk/ http://www.post-polio.org.uk/ From amidgley at gmail.com Sun Jun 3 10:55:27 2012 From: amidgley at gmail.com (Adrian Midgley) Date: Sun, 3 Jun 2012 10:55:27 +0100 Subject: President Obama Ordered Stuxnet and More Attacks on Iran (June 1, 2012) In-Reply-To: <4FC90A85.3050805@originalthinktank.org.uk> References: <4FC90A85.3050805@originalthinktank.org.uk> Message-ID: Should we regard Windows as the first shot in a cyberwar? -- Adrian Midgley?? http://www.defoam.net/ From chris-ukcrypto at lists.skipnote.org Wed Jun 6 16:32:52 2012 From: chris-ukcrypto at lists.skipnote.org (Chris Edwards) Date: Wed, 6 Jun 2012 16:32:52 +0100 (BST) Subject: Data collection in government In-Reply-To: References: Message-ID: On Thu, 31 May 2012, Ian Batten wrote: > Does any know what the source is for the logged copies of all the text > messages between Jeremy Hunt and assorted members of his circle? Sort-of related: http://amberhawk.typepad.com/amberhawk/2012/06/do-all-conservative-ministers-use-personal-emails-and-texts-to-avoid-foia.html From maxsec at gmail.com Thu Jun 14 09:14:51 2012 From: maxsec at gmail.com (Martin Hepworth) Date: Thu, 14 Jun 2012 09:14:51 +0100 Subject: latest plans to monitor internet use in the UK Message-ID: http://www.bbc.co.uk/news/uk-politics-18434112 Currently the "How it would work" seems to be 404-ing.. Also on Radio 4 Today Program interview with Home Secretary and David Davies just after 7.30am News in case you missed it. Interesting was quoted as saying 500,000 such requests where made in 2010 for fixed and mobile phone data, but no mention of that how much of that 500,000 lead to prosecutions. http://www.guardian.co.uk/world/2012/jun/13/online-privacy-legislation-internet-phone-data saying Home Office will pay for the equipment at ISPs, but can't see anything as to who will control the equipment. Still lots of privacy concerns about lack of court issued warrants from many people though -- Martin Hepworth, CISSP Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: From marcus at connectotel.com Thu Jun 14 09:20:34 2012 From: marcus at connectotel.com (Marcus Williamson) Date: Thu, 14 Jun 2012 09:20:34 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References: Message-ID: <8m7jt7p4usf14dsnc65i93rtc1t477eh46@4ax.com> On Thu, 14 Jun 2012 09:14:51 +0100, you wrote: >Currently the "How it would work" seems to be 404-ing.. Here's the link: http://www.bbc.co.uk/news/uk-18434232 From lists at internetpolicyagency.com Thu Jun 14 12:53:35 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Thu, 14 Jun 2012 12:53:35 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References: Message-ID: In article , Martin Hepworth writes >Interesting was quoted as saying 500,000 such requests where made in >2010 for fixed and mobile phone data, but no mention of that how much >of that 500,000 lead to prosecutions Most of those are reverse-DQ, and each investigation might involve hundreds of them. So I think we need a more sophisticated metric regarding the "hit rate", and specifically concentrate on the minority of requests which aren't reverse-DQ. -- Roland Perry From colinthomson1 at o2.co.uk Thu Jun 14 13:33:21 2012 From: colinthomson1 at o2.co.uk (Tom Thomson) Date: Thu, 14 Jun 2012 13:33:21 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: <8m7jt7p4usf14dsnc65i93rtc1t477eh46@4ax.com> References: <8m7jt7p4usf14dsnc65i93rtc1t477eh46@4ax.com> Message-ID: <6D6EF7256C3A43048B2BB47F8C43260A@your41b8d18ede> The met commissioner says this will help them conduct a war on crime, but I suspect he means a war on civil liberties. > On Thu, 14 June 2012 09:21, Marcus Williamson wrote: > > >Currently the "How it would work" seems to be 404-ing.. > > Here's the link: > http://www.bbc.co.uk/news/uk-18434232 From igb at batten.eu.org Fri Jun 15 09:01:56 2012 From: igb at batten.eu.org (Ian Batten) Date: Fri, 15 Jun 2012 09:01:56 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References: Message-ID: On 14 Jun 2012, at 09:14, Martin Hepworth wrote: > > Still lots of privacy concerns about lack of court issued warrants from many people though Draft legislation here: http://www.official-documents.gov.uk/document/cm83/8359/8359.pdf ian -------------- next part -------------- An HTML attachment was scrubbed... URL: From lists at internetpolicyagency.com Fri Jun 15 09:58:14 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Fri, 15 Jun 2012 09:58:14 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References:

Message-ID: In article , Ian Batten writes >Draft legislation here: > >http://www.official-documents.gov.uk/document/cm83/8359/8359.pdf Looks like "RIPA Part 2 Chapter 2" v2.0 for disclosure, but doesn't go beyond the Data Retention Directive's existing scope for gathering the data. The TAB's role is extended to include comms data gathering as well as interception. All the same arguments as for RIPA comms data apply (dust off those 12-year-old briefing papers now!) I enjoyed taking the lead for UK industry back then, this time I suppose I'll be watching from the sidelines. ps. The "filtering" stuff seems to be a very complex way of delivering the underlying concept[1] behind "everything up to the first single slash in a url" which begat the tailpiece in RIPA 21(6). [1] Where to put the line in the sand between content and comms data, given that there's no obvious concrete in which to install an armco barrier. -- Roland Perry From fjmd1a at gmail.com Fri Jun 15 10:17:06 2012 From: fjmd1a at gmail.com (Francis Davey) Date: Fri, 15 Jun 2012 10:17:06 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References:

Message-ID: 2012/6/15 Roland Perry : > > > Looks like "RIPA Part 2 Chapter 2" v2.0 for disclosure, but doesn't go > beyond the Data Retention Directive's existing scope for gathering the data. > The TAB's role is extended to include comms data gathering as well as > interception. > In principle it allows the government to force data retention much more widely than the directive. It can impose obligations on anyone for the purpose. Anyway, I've already said this in detail on several other lists, so I had probably better be quiet. -- Francis Davey From lists at internetpolicyagency.com Fri Jun 15 11:41:10 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Fri, 15 Jun 2012 11:41:10 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References:

Message-ID: In article , Francis Davey writes >> Looks like "RIPA Part 2 Chapter 2" v2.0 for disclosure, but doesn't go >> beyond the Data Retention Directive's existing scope for gathering the data. >> The TAB's role is extended to include comms data gathering as well as >> interception. > >In principle it allows the government to force data retention much >more widely than the directive. It can impose obligations on anyone >for the purpose. Are you referring to the missing "public" in front of "Telecomms Operators"? Perhaps an attempt to bring large private networks like Janet into the fray. -- Roland Perry From otcbn at callnetuk.com Fri Jun 15 15:20:54 2012 From: otcbn at callnetuk.com (Peter Mitchell) Date: Fri, 15 Jun 2012 15:20:54 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References:

Message-ID: <4FDB44C6.5030806@callnetuk.com> Roland Perry wrote: > In article > , > Francis Davey writes >>> Looks like "RIPA Part 2 Chapter 2" v2.0 for disclosure, but doesn't go >>> beyond the Data Retention Directive's existing scope for gathering >>> the data. >>> The TAB's role is extended to include comms data gathering as well as >>> interception. >> >> In principle it allows the government to force data retention much >> more widely than the directive. It can impose obligations on anyone >> for the purpose. > > Are you referring to the missing "public" in front of "Telecomms > Operators"? Perhaps an attempt to bring large private networks like > Janet into the fray. Section 25 requires postal operators to keep records of all letters and parcels sent and received in the UK. This is causing some consternation at the Royal Mail. Neither it nor its sponsoring government department (BIS) were consulted about the measure, nor even told about it until a ZDnet reporter noticed it. http://www.zdnet.co.uk/blogs/communication-breakdown-10000030/going-postal-does-the-reasoning-behind-the-snoopers-charter-stand-up-10026407/ -- Pete Mitchell From fjmd1a at gmail.com Fri Jun 15 15:27:23 2012 From: fjmd1a at gmail.com (Francis Davey) Date: Fri, 15 Jun 2012 15:27:23 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: <4FDB44C6.5030806@callnetuk.com> References:

<4FDB44C6.5030806@callnetuk.com> Message-ID: 2012/6/15 Peter Mitchell : > > > Section 25 requires postal operators to keep records of all letters and > parcels sent and received in the UK. > No it doesn't. http://wiki.openrightsgroup.org/wiki/Communications_Data_Bill/Draft#General_provisions Like the rest of the act it doesn't require anyone to keep any particular data, that will be left to the orders made under clause 1. "could require" would be a better way to put it. -- Francis Davey From otcbn at callnetuk.com Fri Jun 15 15:53:17 2012 From: otcbn at callnetuk.com (Peter Mitchell) Date: Fri, 15 Jun 2012 15:53:17 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References:

<4FDB44C6.5030806@callnetuk.com> Message-ID: <4FDB4C5D.2070702@callnetuk.com> Francis Davey wrote: > 2012/6/15 Peter Mitchell : >> >> Section 25 requires postal operators to keep records of all letters and >> parcels sent and received in the UK. >> > > No it doesn't. > > http://wiki.openrightsgroup.org/wiki/Communications_Data_Bill/Draft#General_provisions > > Like the rest of the act it doesn't require anyone to keep any > particular data, that will be left to the orders made under clause 1. > "could require" would be a better way to put it. > I doubt the government is enacting a highly controversial bill to give itself new powers that it does not intend to use. From fjmd1a at gmail.com Fri Jun 15 16:03:14 2012 From: fjmd1a at gmail.com (Francis Davey) Date: Fri, 15 Jun 2012 16:03:14 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: <4FDB4C5D.2070702@callnetuk.com> References:

<4FDB44C6.5030806@callnetuk.com> <4FDB4C5D.2070702@callnetuk.com> Message-ID: 2012/6/15 Peter Mitchell : > I doubt the government is enacting a highly controversial bill to give > itself new powers that it does not intend to use. > That's entirely possible, though it has happened. My point is that it is incorrect to say that the Bill (as an Act) would require something, rather it would enable to government to make an order requiring something. Those are distinct propositions. When I was involved in running the "Save Parliament" campaign we had to work very hard with a bill which initially allowed the government to do anything by order. We could have said "the Legislative and Regulatory Reform Bill forces everyone to wear green trousers" but that would have been false, even though the bill did allow the government to order that to happen. So the argument has to be more nuanced. Instead of saying: now this will happen, the argument is: this could happen. The objection is not to anything in particular but to giving the government a blank cheque by which they could order anything in particular. Clause 1 is extremely general and is nothing like what went before. It can be directed at anyone and order them to do almost anything that is rationally connected to the purpose of retaining comms data. Since almost any comms device is a "telecommunications system" anyone controlling such a device is a "telecommunications operator" its not surprising they didn't consult with the post office. Anyone with a mobile phone or television is a telecommunications operator. -- Francis Davey From maxsec at gmail.com Fri Jun 15 16:06:28 2012 From: maxsec at gmail.com (Martin Hepworth) Date: Fri, 15 Jun 2012 16:06:28 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References:

<4FDB44C6.5030806@callnetuk.com> Message-ID: On 15 June 2012 15:27, Francis Davey wrote: > 2012/6/15 Peter Mitchell : > > > > > > Section 25 requires postal operators to keep records of all letters and > > parcels sent and received in the UK. > > > > No it doesn't. > > > http://wiki.openrightsgroup.org/wiki/Communications_Data_Bill/Draft#General_provisions > > Like the rest of the act it doesn't require anyone to keep any > particular data, that will be left to the orders made under clause 1. > "could require" would be a better way to put it. > > -- > Francis Davey > > Hmm Section 9-6 on that link seems to cover just about any reason what-so-ever - including a Al Capone style tax reason. -- Martin Hepworth, CISSP Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: From fjmd1a at gmail.com Fri Jun 15 16:18:43 2012 From: fjmd1a at gmail.com (Francis Davey) Date: Fri, 15 Jun 2012 16:18:43 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References:

<4FDB44C6.5030806@callnetuk.com> Message-ID: 2012/6/15 Martin Hepworth : > > Hmm Section 9-6 on that link seems to cover just about any reason > what-so-ever - including a Al Capone style tax reason. Right, but this is one of the *many* "nothing new here" provisions. As far as I can see all of 9(6) except for (c) was already in RIPA or in one of the regs made under it. (c) may be but legislation.gov's search engine seems bust. -- Francis Davey From bdm at fenrir.org.uk Fri Jun 15 16:32:46 2012 From: bdm at fenrir.org.uk (Brian Morrison) Date: Fri, 15 Jun 2012 16:32:46 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References:

<4FDB44C6.5030806@callnetuk.com> <4FDB4C5D.2070702@callnetuk.com> Message-ID: <20120615163246.00001912@surtees.fenrir.org.uk> On Fri, 15 Jun 2012 16:03:14 +0100 Francis Davey wrote: > The objection is not > to anything in particular but to giving the government a blank cheque > by which they could order anything in particular. The government always argues that it does this because it does not want to have to bring forth further primary legislation, instead changes can be made by SI. Personally I intensely dislike this method of lawmaking, it smacks of the inability to decide on a course of action or to understand the dangers of allowing SIs to be passed with little or no scrutiny. -- Brian Morrison From fjmd1a at gmail.com Fri Jun 15 16:37:16 2012 From: fjmd1a at gmail.com (Francis Davey) Date: Fri, 15 Jun 2012 16:37:16 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: <20120615163246.00001912@surtees.fenrir.org.uk> References:

<4FDB44C6.5030806@callnetuk.com> <4FDB4C5D.2070702@callnetuk.com> <20120615163246.00001912@surtees.fenrir.org.uk> Message-ID: 2012/6/15 Brian Morrison : > > The government always argues that it does this because it does not want > to have to bring forth further primary legislation, instead changes can > be made by SI. > > Personally I intensely dislike this method of lawmaking, it smacks of > the inability to decide on a course of action or to understand the > dangers of allowing SIs to be passed with little or no scrutiny. > Quite. Not having to think about legislation and have it subject to parliamentary scrutiny is much nicer from a government perspective. Here technology is part of the excuse. "We may want all sorts of things we can't predict" is a common reason for not actually nailing down the policy in the act. It also allows some real deniability. Often lots of the plans really aren't there. I too dislike it as a form of law-making. -- Francis Davey From otcbn at callnetuk.com Fri Jun 15 16:46:31 2012 From: otcbn at callnetuk.com (Peter Mitchell) Date: Fri, 15 Jun 2012 16:46:31 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: <20120615163246.00001912@surtees.fenrir.org.uk> References:

<4FDB44C6.5030806@callnetuk.com> <4FDB4C5D.2070702@callnetuk.com> <20120615163246.00001912@surtees.fenrir.org.uk> Message-ID: <4FDB58D7.4010101@callnetuk.com> Brian Morrison wrote: > On Fri, 15 Jun 2012 16:03:14 +0100 > Francis Davey wrote: > >> The objection is not >> to anything in particular but to giving the government a blank cheque >> by which they could order anything in particular. > > The government always argues that it does this because it does not want > to have to bring forth further primary legislation, instead changes can > be made by SI. It's an intrinsically weak argument, in that the only people who would accept it are those who already agree that government should have the power to do anything it likes by administrative fiat. Such people are not likely to be the ones opposing this measure. > Personally I intensely dislike this method of lawmaking, it smacks of > the inability to decide on a course of action or to understand the > dangers of allowing SIs to be passed with little or no scrutiny. It's a bit like those clauses that employers sometimes try to get you to sign, in which you have to promise to indemnify them against every possible consequence of employing you. When you demur, they reply, "Oh but we wouldn't ever actually invoke that clause, it's just company policy to have it in there ..." From Andrew.Cormack at ja.net Fri Jun 15 13:42:31 2012 From: Andrew.Cormack at ja.net (Andrew Cormack) Date: Fri, 15 Jun 2012 12:42:31 +0000 Subject: latest plans to monitor internet use in the UK In-Reply-To: References:

Message-ID: <61E52F3A5532BE43B0211254F13883AE09F70FCE@EXC001> > -----Original Message----- > From: ukcrypto-bounces at chiark.greenend.org.uk [mailto:ukcrypto- > bounces at chiark.greenend.org.uk] On Behalf Of Roland Perry > Sent: 15 June 2012 11:41 > To: ukcrypto at chiark.greenend.org.uk > Subject: Re: latest plans to monitor internet use in the UK > > In article > , > Francis Davey writes > >> Looks like "RIPA Part 2 Chapter 2" v2.0 for disclosure, but doesn't > go > >> beyond the Data Retention Directive's existing scope for gathering > the data. > >> The TAB's role is extended to include comms data gathering as well > as > >> interception. > > > >In principle it allows the government to force data retention much > >more widely than the directive. It can impose obligations on anyone > >for the purpose. > > Are you referring to the missing "public" in front of "Telecomms > Operators"? Perhaps an attempt to bring large private networks like > Janet into the fray. > -- > Roland Perry I'd noticed the absence of "public". Actually as far as I can see the definition of "telecommunications providers" covers pretty much every organisation in the land (and most homes too). No idea whether it's deliberate (could it just be a cut'n'paste from the RIPA access powers?), or targeted at us. If anyone had asked I'd have pointed out the usual problem for anyone who wants to "measure Janet" (remember, we serve researchers, who have such sweet ideas!): multiple paths everywhere within the network and for most external links too (our customers regard JCB-resistance as higher priority than bandwidth nowadays), backbone links running at 100Gbps and a even a lot of customer access links in the multi-Gbps resilient range. That's a lot of black boxes plus some clever packet re-assembly too. Andrew -- Andrew Cormack Chief Regulatory Adviser, Janet t: +44 1235 822302 b: http://webmedia.company.ja.net/edlabblogs/regulatory-developments/ Janet, the UK's research and education network www.ja.net From rl.hird at orpheusmail.co.uk Fri Jun 15 13:45:05 2012 From: rl.hird at orpheusmail.co.uk (Roger Hird) Date: Fri, 15 Jun 2012 13:45:05 +0100 Subject: Query on security certificates (possibly OT) Message-ID: <52a03781f1rl.hird@orpheusmail.co.uk> I'm not sure if this query is really appropriate to UKCrypto but I'm not sure where else I'd find anyone able to comment on it authoritatively. I have an account with an on-line stockbroker. I'm pleased with their service as a broker but their command of IT seems a bit shaky. As background I use Firefox v.13 as my browser and, at the broker's suggestion, Trustee Rapport. On Monday morning I logged on to find myself able to get to my account page at https://secure.ANONYMISED.co.uk...etc but with a large part of the page obscured by messages from Firefox warning me not to trust the site, with the "technical details": "trading.ANONYMISED.co.uk uses an invalid security certificate. This certificate is only valid for www.ANONYMISED.co.uk" Later in the day a notice appeared on the brokers own log-in page saying that software updates over the weekend had led to browsers giving the warnings I'd quoted but asking customers to ignore them. I queried with the firm whether it was good practice to urge us to use a supposedly secure site that could not present a valid certificate. I got an email reply which confirmed that there were "technical difficulties with the security certificate not recognising [their] secure website" but avoiding answering my question . Am I just being pedantic or should I have doubts about using the site under such circumstances - or their advising customers to do so? The warnings have now disappeared. RogerH -- Roger Hird rl.hird at orpheusmail.co.uk Website: http://roger.hird.orpheusweb.co.uk From lists at internetpolicyagency.com Fri Jun 15 17:41:04 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Fri, 15 Jun 2012 17:41:04 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: <61E52F3A5532BE43B0211254F13883AE09F70FCE@EXC001> References:

<61E52F3A5532BE43B0211254F13883AE09F70FCE@EXC001> Message-ID: In article <61E52F3A5532BE43B0211254F13883AE09F70FCE at EXC001>, Andrew Cormack writes >I'd noticed the absence of "public". Actually as far as I can see the definition of "telecommunications providers" covers pretty much every >organisation in the land (and most homes too). No idea whether it's deliberate (could it just be a cut'n'paste from the RIPA access powers?) Apologies, I was thinking of Ch1. As you correctly remind me, Ch2 of RIPA has always said: "...where it appears to the designated person that a postal or telecommunications operator is or may be in possession of, or be capable of obtaining, any communications data..." -- Roland Perry From jim at openrightsgroup.org Fri Jun 15 15:56:38 2012 From: jim at openrightsgroup.org (Jim Killock) Date: Fri, 15 Jun 2012 15:56:38 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: <4FDB4C5D.2070702@callnetuk.com> References:

<4FDB44C6.5030806@callnetuk.com> <4FDB4C5D.2070702@callnetuk.com> Message-ID: Hi all, We have a series of events to get the campaigning going at the grassroots, and help people workm with their MPs. You folks would be really welcome at them. http://www.openrightsgroup.org/events/2012/censorship-and-surveillance-campaign-training London, Wednesday, 20 June 2012 Edinburgh, Saturday, 23 June 2012 Manchester, Wednesday, 27 June 2012 Sheffield, Thursday, 28 June 2012 Birmingham, Wednesday, 4 July 2012 Bristol, Saturday, 7 July 2012 Hope to see some of you there, Jim Jim Killock Executive Director Open Rights Group Skype: jimkillock Email: jim at openrightsgroup.org http://twitter.com/jimkillock http://www.openrightsgroup.org/ -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 203 bytes Desc: Message signed with OpenPGP using GPGMail URL: From lists at internetpolicyagency.com Fri Jun 15 17:55:38 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Fri, 15 Jun 2012 17:55:38 +0100 Subject: Query on security certificates (possibly OT) In-Reply-To: <52a03781f1rl.hird@orpheusmail.co.uk> References: <52a03781f1rl.hird@orpheusmail.co.uk> Message-ID: <6QP32C+Kk22PFAgH@perry.co.uk> In article <52a03781f1rl.hird at orpheusmail.co.uk>, Roger Hird writes >On Monday morning I logged on to find myself able to get to my >account page at https://secure.ANONYMISED.co.uk...etc but with a >large part of the page obscured by messages from Firefox warning >me not to trust the site, with the "technical details": > > "trading.ANONYMISED.co.uk uses an invalid security > certificate. This certificate is only valid for > www.ANONYMISED.co.uk" > >Later in the day a notice appeared on the brokers own log-in page >saying that software updates over the weekend had led to browsers >giving the warnings I'd quoted but asking customers to ignore >them. > >I queried with the firm whether it was good practice to urge us >to use a supposedly secure site that could not present a valid >certificate. I got an email reply which confirmed that there were >"technical difficulties with the security certificate not >recognising [their] secure website" but avoiding answering my >question . > >Am I just being pedantic or should I have doubts about using the >site under such circumstances - or their advising customers to do >so? The warnings have now disappeared. This is a pet peeve of my own too. Earlier this week I received similar "false positive" warnings when invoking the Sky-subscriber authentication page of an O2/Cloud wifi hotspot. yfrog.com/ki2pocp yfrog.com/g0ue3p yfrog.com/h0jmbdp [I don't have a Sky subscription, I pressed it by accident; one of the perils of having a small Android phone and not taking my reading glasses with me]. I have a collection of similar Snafus. This one is a favourite: yfrog.com/nb79ioj -- Roland Perry From rl.hird at orpheusmail.co.uk Fri Jun 15 18:15:15 2012 From: rl.hird at orpheusmail.co.uk (Roger Hird) Date: Fri, 15 Jun 2012 18:15:15 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References:

<4FDB44C6.5030806@callnetuk.com> <4FDB4C5D.2070702@callnetuk.com> <20120615163246.00001912@surtees.fenrir.org.uk> Message-ID: <52a0503dbdrl.hird@orpheusmail.co.uk> In article , Francis Davey wrote: > Quite. Not having to think about legislation and have it > subject to parliamentary scrutiny is much nicer from a > government perspective. > Here technology is part of the excuse. "We may want all sorts > of things we can't predict" is a common reason for not actually > nailing down the policy in the act. It also allows some real > deniability. Often lots of the plans really aren't there. > I too dislike it as a form of law-making. This will be the second time today I've asked a question on this list - both of them only marginally relevant to its purpose, but here we go: While working as a civil servant I more than once came into contact with secondary legislation originally put in place under first world war ("DoRA") and related WWII emergency legislation which had somehow manged to remain in power later - the export control legislation which was used to support NATO policy had its origins there. Reading about DoRA and second world war regulatory powers, it seems to me that during their currency they gave the government, acting by Order in Council, pretty complete powers which could easily, if required, have encompassed the sorts of things the present proposed legislation covers, without even the control of a negative resolution from parliament. I'm not mentioning this in support of what is proposed but to comment that such things could have been envisaged in the past but only at a time of world war. RogerH -- Roger Hird rl.hird at orpheusmail.co.uk Website: http://roger.hird.orpheusweb.co.uk From zenadsl6186 at zen.co.uk Fri Jun 15 21:41:49 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Fri, 15 Jun 2012 21:41:49 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: <6D6EF7256C3A43048B2BB47F8C43260A@your41b8d18ede> References: <8m7jt7p4usf14dsnc65i93rtc1t477eh46@4ax.com> <6D6EF7256C3A43048B2BB47F8C43260A@your41b8d18ede> Message-ID: <4FDB9E0D.3080504@zen.co.uk> Tom Thomson wrote: > The met commissioner says this will help them conduct a war on crime, but I suspect he means a war on civil liberties. > >> On Thu, 14 June 2012 09:21, Marcus Williamson wrote: >> >>> Currently the "How it would work" seems to be 404-ing.. >> Here's the link: >> http://www.bbc.co.uk/news/uk-18434232 I don't get it. Suppose my ISP records all the in/out IPs of every packet sent to /from me, and Alice's ISP does the same for Alice. I talk to Alice on a facebook forum. How does this help show I talked to Alice? (never mind ssl/tls on googlemail - hmm, can you send email to a googlemail address via ssl/tls web rather than via email?) I'm looking at the filtering bit in the draft Act, and I can't understand what it's all about. Perhaps the authors don't know either, or perhaps they are doing a good job of obfuscation. The data collection part, Part 1, says they can collect comms data - defined much the same as in RIPA - and 1(4) says: "Nothing in this Part authorises any conduct consisting in the interception of communications in the course of their transmission by means of a telecommunication system." so, if it's the ISPs who collect only the same comms data, and dish the relevant dribbles out on demand/request while keeping the mass of data secure, it just means they collect a bit more, and keep it for however long - much the same overall though, no big difference (and there would be no need for an Act to make only those changes, they could be made under RIPA by SI). A (the?) _really_ big problem would arise if comms data is made available en mass to the filtering operation, which may or may not be operated by the ISPs - afaics Schedule 1 and clause 20 mean the filtering could be operated by GCHQ, or whoever the Secretary wants to run it. The ISPs wouldn't have the option to refuse. And I haven't seen anything which limits the scope of an authorisation to a set of premises, or a person, or whatever - so a single blanket authorisation might be enough for GCHQ to obtain all the comms data an ISP collects. (and they did almost exactly that regarding intercepting semi-foreign comms, they issued a blanket warrant because the strict legal restriction on the scope of a warrant under RIPA only applied to comms where both the sender and recipient are in the UK) Oh, it gets put through filters after CGHQ sweeps it up, and GCHQ's clients can only see filter product when properly authorised .. so that's okay then, not. But as I said before, I don't get it. I don't understand what they are trying to do. I probably will, eventually, but not yet. Thing is, afaict the draft Act allows them to do exactly that extremely nasty stuff - and that's the only reason I can see for having all the guff about filters in there, or indeed to have an Act at all. -- Peter Fairbrother From fjmd1a at gmail.com Fri Jun 15 23:09:04 2012 From: fjmd1a at gmail.com (Francis Davey) Date: Fri, 15 Jun 2012 23:09:04 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: <4FDB9E0D.3080504@zen.co.uk> References: <8m7jt7p4usf14dsnc65i93rtc1t477eh46@4ax.com> <6D6EF7256C3A43048B2BB47F8C43260A@your41b8d18ede> <4FDB9E0D.3080504@zen.co.uk> Message-ID: 2012/6/15 Peter Fairbrother : > > so, if it's the ISPs who collect only the same comms data, and dish the > relevant dribbles out on demand/request while keeping the mass of data > secure, it just means they collect a bit more, and keep it for however long > - much the same overall though, no big difference (and there would be no > need for an Act to make only those changes, they could be made under RIPA by > SI). The use data of (say) facebook is communications data. Facebook is a telecommunications service. If there is any way to make sure that data is retained for later use, clause 1 allows an order to ensure that it is. Ideally by forcing facebook to use GCHQ equipment, but in reality it may be possible to use something at the ISP to do the trick. The reason for clause 1 is that the government can adapt the mechanism depending on what they want to catch. What I'm saying is that the facebook usage data is in scope and the act says that if it could be obtained in any way within the reach of UK law, then the government can do it that way. Obviously if it can't be obtained then it can't and no law we pass will change that. -- Francis Davey From zenadsl6186 at zen.co.uk Sat Jun 16 00:51:54 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sat, 16 Jun 2012 00:51:54 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: References: <8m7jt7p4usf14dsnc65i93rtc1t477eh46@4ax.com> <6D6EF7256C3A43048B2BB47F8C43260A@your41b8d18ede> <4FDB9E0D.3080504@zen.co.uk> Message-ID: <4FDBCA9A.9010004@zen.co.uk> Francis Davey wrote: > 2012/6/15 Peter Fairbrother : >> so, if it's the ISPs who collect only the same comms data, and dish the >> relevant dribbles out on demand/request while keeping the mass of data >> secure, it just means they collect a bit more, and keep it for however long >> - much the same overall though, no big difference (and there would be no >> need for an Act to make only those changes, they could be made under RIPA by >> SI). > > The use data of (say) facebook is communications data. Traffic from facebook customers to facebook? Agreed. Call that primary traffic data, obtainable from IP addresses. > Facebook is a telecommunications service. Suppose I post something on my own website - does that make my website a telecommunications service? Suppose I post something on a webserver with a private URL? Suppose I send Alice a message through facebook. The existence, timing, size etc of my message to facebook is traffic data obtainable from my ISP or facebook's. Is the part where I tell facebook to pass the message on to Alice "secondary" comms data? Suppose I ask Facebook to make some (existing, stored) data available to Alice. The "asking" is a message to Facebook, and content. Alice's looking at the data may be a communication from me - but is my message to facebook comms data, or content, or both? ARE YOU SENDING ALICE MESSAGES? WE WANT TO KNOW ALL ABOUT ALL OF THEM. Whatever, the act of looking for "secondary" comms data in facebook traffic will necessarily include looking at all facebook traffic content to be effective, There is no other way to do it, after all. RIPA 2(5): "References in this Act to the interception of a communication in the course of its transmission ... do not include references to? (a)any conduct that takes place in relation only to so much of the communication as consists in any traffic data comprised in or attached to a communication (whether by the sender or otherwise) for the purposes of any postal service or telecommunication system by means of which it is being or may be transmitted; or (b)any such conduct, in connection with conduct falling within paragraph (a), as gives a person who is neither the sender nor the intended recipient only so much access to a communication as is necessary for the purpose of identifying traffic data so comprised or attached." So I guess clause 1(4), "Nothing in this Part authorises any conduct consisting in the interception of communications .." *does not* mean that looking at *all* internet traffic content is not allowed. You actually are looking at the content of all internet traffic, but it's not interception to do so if you are looking for "secondary traffic data". Figures. I guess the "filtering" comes in here. (as I have said before, there is no other way to do check for facebook, or surreptitious, or steganographic messages that to look at *all* internet traffic, including content. Even then you will miss quite a lot) -- Peter Fairbrother If there is any way to make sure that data > is retained for later use, clause 1 allows an order to ensure that it > is. Ideally by forcing facebook to use GCHQ equipment, but in reality > it may be possible to use something at the ISP to do the trick. > > The reason for clause 1 is that the government can adapt the mechanism > depending on what they want to catch. > > What I'm saying is that the facebook usage data is in scope and the > act says that if it could be obtained in any way within the reach of > UK law, then the government can do it that way. Obviously if it can't > be obtained then it can't and no law we pass will change that. > From igb at batten.eu.org Sat Jun 16 19:18:40 2012 From: igb at batten.eu.org (Ian Batten) Date: Sat, 16 Jun 2012 19:18:40 +0100 Subject: latest plans to monitor internet use in the UK In-Reply-To: <4FDBCA9A.9010004@zen.co.uk> References: <8m7jt7p4usf14dsnc65i93rtc1t477eh46@4ax.com> <6D6EF7256C3A43048B2BB47F8C43260A@your41b8d18ede> <4FDB9E0D.3080504@zen.co.uk> <4FDBCA9A.9010004@zen.co.uk> Message-ID: <5D6FA69D-2945-4BC7-ACB9-20B93E8AAF75@batten.eu.org> On 16 Jun 2012, at 00:51, Peter Fairbrother wrote: > > Whatever, the act of looking for "secondary" comms data in facebook traffic will necessarily include looking at all facebook traffic content to be effective, There is no other way to do it, after all. Yes, and that's going to require (a) the co-operation of Facebook, for encrypted traffic, or (b) the "filtering" provisions to extract "who is messaging who" (authorisable by senior officers) without --- the legislation intends --- extracting content (which requires home secretary). ian From fjmd1a at gmail.com Sat Jun 16 23:56:00 2012 From: fjmd1a at gmail.com (Francis Davey) Date: Sat, 16 Jun 2012 23:56:00 +0100 Subject: https - hopefully not too stupid a question Message-ID: This is the first question I have initiated on this group, so I hope it does not seem to be too foolish a query. Reading: http://fsfe.org/news/2012/news-20120616-01.html I wondered to what extent the government could put a framework in place to avoid some of these, in particular the use of https. Could the government set things up within the UK so that certificates were forged so that they were able to intercept https in transit? Assume that the Bill gives them the legal power to require anyone in the UK to do anything in order to facilitate obtaining comms data could they use that power to require someone/anyone to issue certificates purporting to be for sites (like facebook)? I am not sure how easy it is for a state actor to do this in a way that will affect ordinary people. I'm not interested in whether the technically savvy are able to avoid such action - let us stipulate for the sake of argument that they are. Thanks. -- Francis Davey From alec.muffett at gmail.com Sun Jun 17 07:48:11 2012 From: alec.muffett at gmail.com (Alec Muffett) Date: Sun, 17 Jun 2012 07:48:11 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: Message-ID: <8A00991A-2B69-4360-BA6D-185FD37ACEC9@gmail.com> On 16 Jun 2012, at 23:56, Francis Davey wrote: > I wondered to what extent the government could put a framework in > place to avoid some of these, in particular the use of https. Could > the government set things up within the UK so that certificates were > forged so that they were able to intercept https in transit? Yes it is theoretically possible in the UK for the state to man-in-the-middle some SSL communications quite easily, however: - "man in the middle" (MITM) requires you to be *in* the middle of the relevant communication; - therefore it's easiest when you can park your equipment immediately upstream of one of the two endpoints, or you can guarantee that the communication you desire to intercept will pass through a section of core network which you control; the latter is harder... - therefore it's most economical when you are MITM-ing all the SSL traffic coming from one user (by interposing yourself between the Internet and their specific communications devices/DSL) or all of the traffic going into one site (e.g.: some UK host, or anything leaving the UK en-route for Google.com and passing through the transatlantic fibres) - otherwise you rapidly run into a N-squared / N x M problem where you have to interpose yourself *everywhere* and *ubiquitously* which would be massively expensive MITM can sometimes be found out nowadays because a small number of people are running technologies like Convergence (See: http://www.youtube.com/watch?v=Z7Wl2FW2TcA - I consider this a must-see video for the perspective it imparts) which eschews the trust model of Certificate Authorities in favour of a real-time check that the certificate you see for GMail in the UK is the same as is presented in the USA, Canada, Finland, Russia, Brazil? i.e.: that nobody is lying to you without lying to them as well. Ben Laurie / Google also have some ideas towards some of the same risks (http://www.imperialviolet.org/2011/11/29/certtransparency.html) - my personal opinion of which is that they have a point but their threat model does not take adequate consideration of state-based MITM; so I'd like to have both certificate-pinning *and* convergence monitoring, please. So for the moment I would consider blanket state-based SSL MITM to be a risk for "people of interest" to the state, but not for the population as a whole; basically they could park some device similar to this: http://arstechnica.com/business/2012/02/critics-slam-ssl-authority-for-minting-cert-used-to-impersonate-sites/ ?upstream of the user, which (because of the architecture of trust defined by the Certificate Authority model) can only be defended against at large by less-than-concrete means: http://www.theregister.co.uk/2012/02/14/trustwave_analysis/ But for cost and integration reasons I would imagine that for the "maintenance" of interception capabilities the banning VPNs and Tor is a far more likely pan-UK risk in the short to medium term. > Assume that the Bill gives them the legal power to require anyone in > the UK to do anything in order to facilitate obtaining comms data > could they use that power to require someone/anyone to issue > certificates purporting to be for sites (like Facebook)? Yes, although given what happened to Stuxnet it is probably possible to just fake one up if the goal is important enough: http://threatpost.com/en_us/blogs/flame-attackers-used-collision-attack-forge-microsoft-certificate-060512 ?but legal coercion / "let us plug in this magic box for a while" is a much cheaper alternative. -a From chris-ukcrypto at lists.skipnote.org Sun Jun 17 11:29:31 2012 From: chris-ukcrypto at lists.skipnote.org (Chris Edwards) Date: Sun, 17 Jun 2012 11:29:31 +0100 (BST) Subject: https - hopefully not too stupid a question In-Reply-To: References: Message-ID: On Sat, 16 Jun 2012, Francis Davey wrote: > I wondered to what extent the government could put a framework in > place to avoid some of these, in particular the use of https. Could > the government set things up within the UK so that certificates were > forged so that they were able to intercept https in transit? [ I'd written this basic reply before seeing Alec's more sophisticated one, but may as well send it anyway ] Firstly -- although expensive and impractical -- they could MTIM traffic, causing browsers to display certificate warning message. Need to educate everyone to not ignore such warnings - as this is TLS/SSL operating as designed. However, I suspect you're interested in what circumstances an attack can be performed *without* causing a certificate error. Commercial boxes are available, usually intended to be deployed in enterprises, for example as part of an attempt to prevent staff accidently downloading malware. The box holds an "intermediate signing certificate", which it uses to on-the-fly sign a cert for every https site users access. For this to work without a browser cert warning, it is necessary for a root certificate *which trusts the intermediate certificate installed on the box* to be installed on every client PC. Enterprises control generally their PCs, so can do this. Outwith the enterprise environment, however, things are a little different. A govt would need to persuade a certificate authority (CA) to supply the intermediate signing cert. This goes against all the rules, and in theory should not be allowed. But let's say the UK govt was able to obtain such a cert. ( a flaw in the existing model is *any* CA can issue such a thing, if they are hacked, or minded to do so - and there are a lot of CAs ) The govt _could_ keep the cert for "special occasions". But if however (as seems to be suggested) they want to intercept all the data all the time, the following would happen: Although browsers don't ostensibly throw a warning, some technically savvy people would notice certificate *details* changing, for every site. In particular, the chain-of-trust (click the padlock to view) would be different. At this point, word would get round, the game would be up, and the cert would quickly become almost useless. The CA who signed the intermediate cert would almost certainly have their root cert pulled by the browser makers, and the CA would go out of business. As noted elsewhere (Hi Jon) fear of this could well be sufficient to make it highly unlikely any CA would issue such a cert in the first place. > Assume that the Bill gives them the legal power to require anyone in > the UK to do anything in order to facilitate obtaining comms data Anyone know if the UK has a local CA the govt could lean on ? Either way, as I said, it would be suicide for any CA to issue such a cert. > I'm not interested in whether the technically savvy are able to avoid > such action - let us stipulate for the sake of argument that they are. The events I describe above would likely involve technically savvy people, but the results (removing the compromised cert, and indeed removing the CA) would benefit everyone, including the non-savvy. More info here: http://www.complicity.co.uk/blog/2012/06/spooks-in-the-middle/ I personally think it unlikely the UK govt would be stupid enough to try this. If they want data on encrypted communications, I think it's more likely they'd use legislation to get Facebook / Twitter to store and hand over the data of UK users. Assuming these companies wish to have an office in the UK, they would presumably have no choice but to comply. However, as I understand it, this Bill allows for both possibilities. From fjmd1a at gmail.com Sun Jun 17 12:05:00 2012 From: fjmd1a at gmail.com (Francis Davey) Date: Sun, 17 Jun 2012 12:05:00 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References:

Message-ID: 2012/6/17 Chris Edwards : > > However, as I understand it, this Bill allows for both possibilities. > That's right. Facebook etc could be ordered to keep the relevant information and make it available, certification authorities could be ordered to produce fake certificates. "Could be" in the sense you'd need to pass an SI giving the Secretary of State the power to do so - its not in the act, merely potentially in the act. Of course non-domestic organisations might refuse, there might be numerous implications and complications of a legal kind that would persuade a government not to do it. -- Francis Davey From roger at hayter.org Sun Jun 17 09:48:49 2012 From: roger at hayter.org (Roger Hayter) Date: Sun, 17 Jun 2012 09:48:49 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <8A00991A-2B69-4360-BA6D-185FD37ACEC9@gmail.com> References: <8A00991A-2B69-4360-BA6D-185FD37ACEC9@gmail.com> Message-ID: In message <8A00991A-2B69-4360-BA6D-185FD37ACEC9 at gmail.com>, Alec Muffett writes > >On 16 Jun 2012, at 23:56, Francis Davey wrote: > >> I wondered to what extent the government could put a framework in >> place to avoid some of these, in particular the use of https. Could >> the government set things up within the UK so that certificates were >> forged so that they were able to intercept https in transit? > >Yes it is theoretically possible in the UK for the state to >man-in-the-middle some SSL communications quite easily, however: > >- "man in the middle" (MITM) requires you to be *in* the middle of the >relevant communication; > >- therefore it's easiest when you can park your equipment immediately >upstream of one of the two endpoints, or you can guarantee that the >communication you desire to intercept will pass through a section of >core network which you control; the latter is harder... > >- therefore it's most economical when you are MITM-ing all the SSL >traffic coming from one user (by interposing yourself between the >Internet and their specific communications devices/DSL) or all of the >traffic going into one site (e.g.: some UK host, or anything leaving >the UK en-route for Google.com and passing through the transatlantic >fibres) > >- otherwise you rapidly run into a N-squared / N x M problem where you >have to interpose yourself *everywhere* and *ubiquitously* which would >be massively expensive > >MITM can sometimes be found out nowadays because a small number of >people are running technologies like Convergence (See: >http://www.youtube.com/watch?v=Z7Wl2FW2TcA - I consider this a must-see >video for the perspective it imparts) which eschews the trust model of >Certificate Authorities in favour of a real-time check that the >certificate you see for GMail in the UK is the same as is presented in >the USA, Canada, Finland, Russia, Brazil? i.e.: that nobody is lying >to you without lying to them as well. > >Ben Laurie / Google also have some ideas towards some of the same risks >(http://www.imperialviolet.org/2011/11/29/certtransparency.html) - my >personal opinion of which is that they have a point but their threat >model does not take adequate consideration of state-based MITM; so I'd >like to have both certificate-pinning *and* convergence monitoring, please. > >So for the moment I would consider blanket state-based SSL MITM to be a >risk for "people of interest" to the state, but not for the population >as a whole; basically they could park some device similar to this: > > >http://arstechnica.com/business/2012/02/critics-slam-ssl-authority-for-m >inting-cert-used-to-impersonate-sites/ > >?upstream of the user, which (because of the architecture of trust >defined by the Certificate Authority model) can only be defended >against at large by less-than-concrete means: > > http://www.theregister.co.uk/2012/02/14/trustwave_analysis/ > >But for cost and integration reasons I would imagine that for the >"maintenance" of interception capabilities the banning VPNs and Tor is >a far more likely pan-UK risk in the short to medium term. > >> Assume that the Bill gives them the legal power to require anyone in >> the UK to do anything in order to facilitate obtaining comms data >> could they use that power to require someone/anyone to issue >> certificates purporting to be for sites (like Facebook)? > >Yes, although given what happened to Stuxnet it is probably possible to >just fake one up if the goal is important enough: > > >http://threatpost.com/en_us/blogs/flame-attackers-used-collision-attack- >forge-microsoft-certificate-060512 > >?but legal coercion / "let us plug in this magic box for a while" is >a much cheaper alternative. > > -a Another naive question I am afraid: If an organisation published a suitable key in the newspapers and the organisation itself avoided legal or illegal state penetration of its private information, would that enable individuals to set up secure two way communication with said organisation regardless of any MITM? -- Roger Hayter From lists at internetpolicyagency.com Sun Jun 17 13:49:13 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Sun, 17 Jun 2012 13:49:13 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: Message-ID: In article , Francis Davey writes >This is the first question I have initiated on this group, so I hope >it does not seem to be too foolish a query. > >Reading: > >http://fsfe.org/news/2012/news-20120616-01.html > >I wondered to what extent the government could put a framework in >place to avoid some of these, in particular the use of https. Could >the government set things up within the UK so that certificates were >forged so that they were able to intercept https in transit? > >Assume that the Bill gives them the legal power to require anyone in >the UK to do anything in order to facilitate obtaining comms data >could they use that power to require someone/anyone to issue >certificates purporting to be for sites (like facebook)? I am not sure >how easy it is for a state actor to do this in a way that will affect >ordinary people. > >I'm not interested in whether the technically savvy are able to avoid >such action - let us stipulate for the sake of argument that they are. I'd like to ask some possibly stupid questions of my own, partly after having looked at the fsfe.org site... fsfe hint #1: Use https ======================= As it happens, I looked at this site today (because it was alleged there was something odd about its certificate (I saw nothing untoward, but what would I know...) Isn't it the case that the url is transmitted "in the clear", and thus the traffic data associated with that access would reveal I looked at blah/blah/thanks.aspx, although the content of that page would be encrypted? Back in the days of RIPA and the "Big Browser", the compromise I negotiated (with invaluable help and advice from several stalwarts of this list) was that: " includes data identifying a computer file or computer program access to which is obtained, or which is run, by means of the communication to the extent only that the file or program is identified by reference to the apparatus in which it is stored." Which was the best proxy we could up for "everything up to the first single forward slash" viz: "https://www.update.microsoft.com I will tiptoe away from a discussion of whether the cloud which is undoubtedly serving these requests today is an "apparatus" or not. My understanding of reading the latest proposals is that rather than stopping at the first single forward slash, the authorities might ask for a filter to be set such that for https requests for this specific site might reveal that the subscriber was looking at: https://www.update.microsoft.com/windowsupdate/v6/ which is not very much more, other than what version of Windows they were looking for updates of (which might or might not be the version of Windows they are running). But it's probably still not "content", and nor has using https hidden anything. fsfe hint #4: Encrypt your emails ================================= If you send a PGP encrypted email the content is more secure, but the headers (who, where, when) aren't. Given that you need an Interception Warrant to access the content of emails, why does encrypting them make you any safer from someone examining the traffic data in the headers? (I'm aware of arguments that maybe not all of the header is traffic data, and some parts - like the Subject - might be construed as content, but using PGP doesn't obscure that potential-content anyway; leaving it blank would be a better protection.) fsfe hints #2 & #3 ================== I don't have equivalent comments, but any pointers welcome. -- Roland Perry From alec.muffett at gmail.com Sun Jun 17 14:01:55 2012 From: alec.muffett at gmail.com (Alec Muffett) Date: Sun, 17 Jun 2012 14:01:55 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <8A00991A-2B69-4360-BA6D-185FD37ACEC9@gmail.com> Message-ID: <90AE1138-4B9B-4594-8073-2FDC97FA8233@gmail.com> On 17 Jun 2012, at 09:48, Roger Hayter wrote: > Another naive question I am afraid: If an organisation published a suitable key in the newspapers and the organisation itself avoided legal or illegal state penetration of its private information, would that enable individuals to set up secure two way communication with said organisation regardless of any MITM? Yes and no, depends on your threat model and paranoia level, as well as software implementations. In short you have to define what you mean by "secure" in this context - otherwise we can do the James Bond thing (give you newspapers with bogus certificates) or the repressive state thing (torture you for merely connecting to [ENTITY] regardless of what you communicated). But assuming a non-torturing western liberal democracy and your not being interesting enough to make it worth faking all your data sources, then yes this is kinda possible, so long as the software supports it. Most browsers don't support it on the basis that it's complicated and only paranoiacs would want to do this. Alas. PGP is _based_ on this principle, however; plus the "web of trust"; and SSH implements what is now called the TOFU (Trust On First Use) model, which attempts to guarantee that next time you return to a site it will be the same one to which you've previously connected, which is almost the same as your scenario. -a From tony.naggs at googlemail.com Sun Jun 17 14:04:53 2012 From: tony.naggs at googlemail.com (Tony Naggs) Date: Sun, 17 Jun 2012 14:04:53 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <8A00991A-2B69-4360-BA6D-185FD37ACEC9@gmail.com> Message-ID: On 17 June 2012 09:48, Roger Hayter wrote: > Another naive question I am afraid: If an organisation published a > suitable key in the newspapers and the organisation itself avoided legal or > illegal state penetration of its private information, would that enable > individuals to set up secure two way communication with said organisation > regardless of any MITM? > As I understand it, for secure web browsing (https) the answer is no that is not going to help at the moment. The underlying Secure Socket Layer (SSL / TLS) software decides to trust the certificate it receives over the internet from Google, Facebook, etc because it is signed with a key it can trace (through a valid chain of signed keys) back to a certificate authority it knows about. Your PC has a certificate store with public root certificates from 10s or 100s of such authorities. SSL will trust the certificate if it is traceable back to *any* one of those authorities. There is no interface to say "for *.google.com trust only this certificate I received in from some trusted means". For encrypted email then PGP's web of trust model gives you direct control of which enryption keys you trust, and which key to use for particular recipients. Cheers, Tony -------------- next part -------------- An HTML attachment was scrubbed... URL: From k.brown at bbk.ac.uk Sun Jun 17 13:30:34 2012 From: k.brown at bbk.ac.uk (k.brown at bbk.ac.uk) Date: Sun, 17 Jun 2012 13:30:34 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References:

Message-ID: On 17 June 2012 11:29, Chris Edwards wrote: > Outwith the enterprise environment, however, things are a little > different. ?A govt would need to persuade a certificate authority (CA) > to supply the intermediate signing cert. ?This goes against all the rules, > and in theory should not be allowed. Maybe they don't need to "persuade". It is at least possible to imagine that a UK (or allied) government security organisation was in on the ground floor of one of the CAs and either effectively owns it or has installed some of its friends and managers and in technical jobs. It wouldn't be the first time that government security had used front companies. In that case they might well have the real root certs anyway and not need to fiddle with anything at short notice in order to keep the key chains looking plausible. Or even quite genuine of either party to an encrypted communication was a customer of the pet CA. I'm not saying this is the case - but the possibility that it might be means the very cautious user of encryption (which of course most of us aren't) would want to check certs in more than one way and possibly not rely on any single issuer. -- Ken Brown From zenadsl6186 at zen.co.uk Sun Jun 17 14:57:42 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sun, 17 Jun 2012 14:57:42 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: Message-ID: <4FDDE256.6000509@zen.co.uk> Francis Davey wrote: > This is the first question I have initiated on this group, so I hope > it does not seem to be too foolish a query. > > Reading: > > http://fsfe.org/news/2012/news-20120616-01.html > > I wondered to what extent the government could put a framework in > place to avoid some of these, in particular the use of https. Could > the government set things up within the UK so that certificates were > forged so that they were able to intercept https in transit? Yes, but they would get caught if they did it surreptitiously and often. Either by certificate comparisons performed by the occasional nerd or security company, or by the black boxes at the ISPs - a black box which simply acts as a tap on the line would have different traffic characteristics, which the ISP would notice, as they measure traffic for peering and payment purposes. There are a couple of other ways they might get caught too. > Assume that the Bill gives them the legal power to require anyone in > the UK to do anything in order to facilitate obtaining comms data > could they use that power to require someone/anyone to issue > certificates purporting to be for sites (like facebook)? I am not sure > how easy it is for a state actor to do this in a way that will affect > ordinary people. Once caught, the offending certificate could be traced to the issuing CA, who would then risk getting excluded from the major browser's "trusted CA" lists - death for a CA. Something perhaps much more interesting, in the Chinese proverbial sense of the word, would be for the gubbmint to obtain the private keys for the websites visited. Once they have those they can easily work out the session keys used just from looking at traffic, without modifying it (unless a DHE SSL/TLS suite [1] is used). They could demand the keys from the websites, if they have a UK presence, under RIPA part 3 (if the keys are dual-purpose, ie used to establish the session key as well as for authentication, which they very often are) - or perhaps under this new Act under some more general power. [1] a DHE suite uses Diffie-Hellman to establish an Ephemeral session key which cannot be worked out from looking at traffic, or through subsequent demands for keys. Each party creates an ephemeral secret (they generate a random number and keep it secret), and the shared secret session key is worked out from them using some clever mathematrickery without exposing those secrets in transmission. The secrets are then discarded, and the session is (should be ) discarded after the session. There are DH suites which are not ephemeral (the server resuses the same secret for all sessions, and does not delete it) - in those cases the session keys can be worked out if the secret is made known, by demand or otherwise. > > I'm not interested in whether the technically savvy are able to avoid > such action - let us stipulate for the sake of argument that they are. For nerds, they might be able to discourage the use of DHE suites ( by replacing a small bit of traffic saying "I don't do that DHE suite, try this non-DHE one instead" when establishing which suite to use at the beginnning of a session. That also would be found out, but it would take longer and there wouldn't be such a big "smoking gun" as in a forged certificate MITM attack. -- Peter Fairbrother > > Thanks. > From colinthomson1 at o2.co.uk Sun Jun 17 14:58:10 2012 From: colinthomson1 at o2.co.uk (Tom Thomson) Date: Sun, 17 Jun 2012 14:58:10 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References:

Message-ID: <41EA8ACD0D8C4DCC86C7D902FEEFBF7E@your41b8d18ede> > http://www.complicity.co.uk/blog/2012/06/spooks-in-the-middle/ > > I personally think it unlikely the UK govt would be stupid enough to try > this. If they want data on encrypted communications, I think it's more > likely they'd use legislation to get Facebook / Twitter to store and hand > over the data of UK users. Assuming these companies wish to have an > office in the UK, they would presumably have no choice but to comply. > > However, as I understand it, this Bill allows for both possibilities. Getting third parties to store this data and make hand it over might be rather difficult. Depending on the country in which the server where the data is captured is situated, it may illegal to do this in that country without a judicial warrant issued by a court in that country, either because such data is considered as content, not comms data, or because software which reliably separates this "comms data" from the content in which it is buried is not available. M. From zenadsl6186 at zen.co.uk Sun Jun 17 15:23:47 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sun, 17 Jun 2012 15:23:47 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: Message-ID: <4FDDE873.8020906@zen.co.uk> Roland Perry wrote: > Isn't it the case that the url is transmitted "in the clear", and thus > the traffic data associated with that access would reveal I looked at > blah/blah/thanks.aspx, although the content of that page would be > encrypted? The URL is (or should be) encrypted if there is a "s" in the http(s) part. -- Peter Fairbrother From lists at internetpolicyagency.com Sun Jun 17 15:31:12 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Sun, 17 Jun 2012 15:31:12 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <4FDDE873.8020906@zen.co.uk> References: <4FDDE873.8020906@zen.co.uk> Message-ID: In article <4FDDE873.8020906 at zen.co.uk>, Peter Fairbrother writes >> Isn't it the case that the url is transmitted "in the clear", and thus >> the traffic data associated with that access would reveal I looked at >> blah/blah/thanks.aspx, although the content of that page would be >> encrypted? > >The URL is (or should be) encrypted if there is a "s" in the http(s) part. So all the connectivity ISP knows is the IP address of the https server, which is back to the situation under RIPA 21(6). -- Roland Perry From chris-ukcrypto at lists.skipnote.org Sun Jun 17 15:38:20 2012 From: chris-ukcrypto at lists.skipnote.org (Chris Edwards) Date: Sun, 17 Jun 2012 15:38:20 +0100 (BST) Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk> Message-ID: On Sun, 17 Jun 2012, Roland Perry wrote: > In article <4FDDE873.8020906 at zen.co.uk>, Peter Fairbrother > writes > > > > The URL is (or should be) encrypted if there is a "s" in the http(s) part. > > So all the connectivity ISP knows is the IP address of the https server, which > is back to the situation under RIPA 21(6). Modern browsers send the hostname (ie. upto first single slash) in the clear, in order to facilities named-based virtual hosting for https. See: http://en.wikipedia.org/wiki/Server_Name_Indication Often, this is not hugely different from simply knowing the IP address of the server. But in some cases, knowing the service name may make it slightly easier to know what's being accessed. From lists at internetpolicyagency.com Sun Jun 17 16:26:36 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Sun, 17 Jun 2012 16:26:36 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk>

Message-ID: In article , Chris Edwards writes >> In article <4FDDE873.8020906 at zen.co.uk>, Peter Fairbrother >> writes >> > >> > The URL is (or should be) encrypted if there is a "s" in the http(s) part. >> >> So all the connectivity ISP knows is the IP address of the https server, which >> is back to the situation under RIPA 21(6). > >Modern browsers send the hostname (ie. upto first single slash) >in the clear, in order to facilities named-based virtual hosting >for https. See: > > http://en.wikipedia.org/wiki/Server_Name_Indication > >Often, this is not hugely different from simply knowing the IP address of >the server. But in some cases, knowing the service name may make it >slightly easier to know what's being accessed. Thank you, that makes a lot of sense. I had a gut feeling that sending an entirely encrypted url off to an IP address might make it difficult to digest, but this explanation clarifies the situation. (Which is exactly the spirit of 21(6), as it happens). -- Roland Perry From zenadsl6186 at zen.co.uk Sun Jun 17 16:33:43 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sun, 17 Jun 2012 16:33:43 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk>

Message-ID: <4FDDF8D7.7080108@zen.co.uk> Chris Edwards wrote: > On Sun, 17 Jun 2012, Roland Perry wrote: > >> In article <4FDDE873.8020906 at zen.co.uk>, Peter Fairbrother >> writes >>> The URL is (or should be) encrypted if there is a "s" in the http(s) part. >> So all the connectivity ISP knows is the IP address of the https server, which >> is back to the situation under RIPA 21(6). > > Modern browsers send the hostname (ie. upto first single slash) > in the clear, in order to facilities named-based virtual hosting > for https. See: > > http://en.wikipedia.org/wiki/Server_Name_Indication > > Often, this is not hugely different from simply knowing the IP address of > the server. But in some cases, knowing the service name may make it > slightly easier to know what's being accessed. > Thanks, I had thought the hostname [1] got exposed sometimes at the beginning of a session, but didn't know the details. Does SNI get used every time, or only on request, eg when a single IP address hosts many different domains? From a monitoring POV that probably doesn't matter any, as if the IP only hosts one domain then the monitors know the hostname anyway, whether SNI is used or not. In practice, the client will normally do a DNS on the hostname before a https connection is established. So if all the client's traffic is being monitored then the monitors will usually have the hostname anyway. [1] but not the full URL, which is encrypted. -- Peter Fairbrother From lists at internetpolicyagency.com Sun Jun 17 16:53:01 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Sun, 17 Jun 2012 16:53:01 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <4FDDF8D7.7080108@zen.co.uk> References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk> Message-ID: In article <4FDDF8D7.7080108 at zen.co.uk>, Peter Fairbrother writes >In practice, the client will normally do a DNS on the hostname before a >https connection is established. So if all the client's traffic is >being monitored then the monitors will usually have the hostname anyway. Hmm, if I try to access: https://65.55.25.59/windowsupdate/v6/thanks.aspx?ln=en&&thankspage=5 (Where 65.55.25.59 is what my DNS translates www.update.microsoft.com into) I get: This is probably not the site you are looking for! You attempted to reach 65.55.25.59, but instead you actually reached a server identifying itself as www.update.microsoft.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of 65.55.25.59. Is this my browser (Chrome) not getting its act together, or is there an infelicity in one of the protocols? -- Roland Perry From tony.naggs at googlemail.com Sun Jun 17 17:19:06 2012 From: tony.naggs at googlemail.com (Tony Naggs) Date: Sun, 17 Jun 2012 17:19:06 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk> Message-ID: On 17 June 2012 16:53, Roland Perry wrote: > Hmm, if I try to access: > > https://65.55.25.59/**windowsupdate/v6/thanks.aspx?**ln=en&&thankspage=5 > > (Where 65.55.25.59 is what my DNS translates www.update.microsoft.cominto) > > I get: > > This is probably not the site you are looking for! > > You attempted to reach 65.55.25.59, but instead you actually reached a > server identifying itself as www.update.microsoft.com. This may be > caused by a misconfiguration on the server or by something more > serious. An attacker on your network could be trying to get you to > visit a fake (and potentially harmful) version of 65.55.25.59. > > Is this my browser (Chrome) not getting its act together, or is there an > infelicity in one of the protocols? > The browser message is being slightly misleading - it has simply found that the text of the website you typed "65.55.25.59" differs the name on the certificate the web server sent it "www.update.microsoft.com". The web browser does not make a connection between the 2, as the translation of the text "65.55.25.59" directly to an IP address & bypassing the name (DNS) lookup is done at a lower layer in the communications stack. An alternative way to avoid making the DNS lookups across the Internet is to keep the name lookup local to your PC by directly adding it the Windows or Unix hosts file with a line something like this: 65.55.25.59 www.microsoft.com Of course doing this would isolate you from knowing about any move Microsoft may make of the service to another server. Wikipedia have a nice explanation http://en.wikipedia.org/wiki/Hosts_%28file%29 Cheers, Tony -------------- next part -------------- An HTML attachment was scrubbed... URL: From zenadsl6186 at zen.co.uk Sun Jun 17 17:24:15 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sun, 17 Jun 2012 17:24:15 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk> Message-ID: <4FDE04AF.5000903@zen.co.uk> Roland Perry wrote: > In article <4FDDF8D7.7080108 at zen.co.uk>, Peter Fairbrother > writes >> In practice, the client will normally do a DNS on the hostname before >> a https connection is established. So if all the client's traffic is >> being monitored then the monitors will usually have the hostname anyway. > > Hmm, if I try to access: > > https://65.55.25.59/windowsupdate/v6/thanks.aspx?ln=en&&thankspage=5 > > (Where 65.55.25.59 is what my DNS translates www.update.microsoft.com into) > > I get: > > This is probably not the site you are looking for! > > You attempted to reach 65.55.25.59, but instead you actually reached a > server identifying itself as www.update.microsoft.com. This may be > caused by a misconfiguration on the server or by something more > serious. An attacker on your network could be trying to get you to > visit a fake (and potentially harmful) version of 65.55.25.59. > > Is this my browser (Chrome) not getting its act together, or is there an > infelicity in one of the protocols? I get (Firefox): Secure Connection Failed 65.55.25.59 uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The certificate is only valid for www.update.microsoft.com. (Error code: sec_error_unknown_issuer) I think the browsers are looking to check the hostname in the requested URL matches the hostname in the certificate - and it doesn't, 65.55.25.59 != www.update.microsoft.com Both actions seem like perfectly good behaviour to me. -- Peter Fairbrother From chris-ukcrypto at lists.skipnote.org Sun Jun 17 17:27:05 2012 From: chris-ukcrypto at lists.skipnote.org (Chris Edwards) Date: Sun, 17 Jun 2012 17:27:05 +0100 (BST) Subject: https - hopefully not too stupid a question In-Reply-To: <4FDDF8D7.7080108@zen.co.uk> References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk> Message-ID: On Sun, 17 Jun 2012, Peter Fairbrother wrote: > Does SNI get used every time, or only on request, eg when a single IP address > hosts many different domains? SNI involves sending the URL hostname in the clear as part of the TLS client HELLO, which is the very first packet of every connection, after the 3-way TCP handshake. At this stage, the client does not know whether server understands, or wishes to see the SNI. So therefore it's always sent, regardless. If the server isn't interested, it will simply ignore it. Older browsers don't do this. But most things post Win XP do. From zenadsl6186 at zen.co.uk Sun Jun 17 17:33:07 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sun, 17 Jun 2012 17:33:07 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <4FDDE256.6000509@zen.co.uk> References: <4FDDE256.6000509@zen.co.uk> Message-ID: <4FDE06C3.1050801@zen.co.uk> Peter Fairbrother wrote: > Something perhaps much more interesting, in the Chinese proverbial sense > of the word, would be for the gubbmint to obtain the private keys for > the websites visited. Once they have those they can easily work out the > session keys used just from looking at traffic, without modifying it > (unless a DHE SSL/TLS suite [1] is used). Just did a little testing, deleted all non-DHE suites i my browser and tried to connect using https - BTW, does anyone know how to find out which suite is in use for a particular connection? For firefox preferably, but any browser. Anyway, GMail allows using a DHE suite, but Twitter and Facebook do not. GMail and Twitter use https as default, Facebook on request only. -- Peter Fairbrother > > They could demand the keys from the websites, if they have a UK > presence, under RIPA part 3 (if the keys are dual-purpose, ie used to > establish the session key as well as for authentication, which they very > often are) - or perhaps under this new Act under some more general power. > > [1] a DHE suite uses Diffie-Hellman to establish an Ephemeral session > key which cannot be worked out from looking at traffic, or through > subsequent demands for keys. > > Each party creates an ephemeral secret (they generate a random number > and keep it secret), and the shared secret session key is worked out > from them using some clever mathematrickery without exposing those > secrets in transmission. The secrets are then discarded, and the session > is (should be ) discarded after the session. > > There are DH suites which are not ephemeral (the server resuses the same > secret for all sessions, and does not delete it) - in those cases the > session keys can be worked out if the secret is made known, by demand or > otherwise. > >> >> I'm not interested in whether the technically savvy are able to avoid >> such action - let us stipulate for the sake of argument that they are. > > For nerds, the gubbmint might be able to discourage the use of DHE suites ( by > replacing a small bit of traffic saying "I don't do that DHE suite, try > this non-DHE one instead" when establishing which suite to use at the > beginnning of a session. > > That also would be found out, but it would take longer and there > wouldn't be such a big "smoking gun" as in a forged certificate MITM > attack. > > > -- Peter Fairbrother > >> >> Thanks. >> > > > From zenadsl6186 at zen.co.uk Sun Jun 17 17:35:55 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sun, 17 Jun 2012 17:35:55 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <4FDDF8D7.7080108@zen.co.uk> References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk> Message-ID: <4FDE076B.3010905@zen.co.uk> Peter Fairbrother wrote: > Chris Edwards wrote: >> On Sun, 17 Jun 2012, Roland Perry wrote: >> >>> In article <4FDDE873.8020906 at zen.co.uk>, Peter Fairbrother >>> writes >>>> The URL is (or should be) encrypted if there is a "s" in the http(s) >>>> part. >>> So all the connectivity ISP knows is the IP address of the https >>> server, which >>> is back to the situation under RIPA 21(6). >> >> Modern browsers send the hostname (ie. upto first single slash) in the >> clear, in order to facilities named-based virtual hosting >> for https. See: >> >> http://en.wikipedia.org/wiki/Server_Name_Indication >> >> Often, this is not hugely different from simply knowing the IP address >> of the server. But in some cases, knowing the service name may make >> it slightly easier to know what's being accessed. >> > > Thanks, I had thought the hostname [1] got exposed sometimes at the > beginning of a session, but didn't know the details. > > Does SNI get used every time, or only on request, eg when a single IP > address hosts many different domains? > > From a monitoring POV that probably doesn't matter any, as if the IP > only hosts one domain then the monitors know the hostname anyway, > whether SNI is used or not. > > > In practice, the client will normally do a DNS on the hostname before a > https connection is established. So if all the client's traffic is being > monitored then the monitors will usually have the hostname anyway. Another case, which might result in all the URL being exposed, is where a connection starts in http then defaults to https - the user types in a full http URL, and the server changes it to https. It happens. -- Peter Fairbrother > > > [1] but not the full URL, which is encrypted. > > -- Peter Fairbrother > > > From fjmd1a at gmail.com Sun Jun 17 17:37:00 2012 From: fjmd1a at gmail.com (Francis Davey) Date: Sun, 17 Jun 2012 17:37:00 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk> Message-ID: 2012/6/17 Chris Edwards : > > SNI involves sending the URL hostname in the clear as part of the TLS > client HELLO, which is the very first packet of every connection, after > the 3-way TCP handshake. ?At this stage, the client does not know whether > server understands, or wishes to see the SNI. ?So therefore it's always > sent, regardless. ?If the server isn't interested, it will simply ignore > it. > > Older browsers don't do this. ?But most things post Win XP do. > That is very interesting. Does that mean that s97A (anti-copyright infringement) ordered blocks could be required to block a particular hostname without having to look inside the http packet, but merely at the TLS client HELLO (or does that count as DPI - I'm never sure what counts as "deep")? In other words you could block newzbin2 from https: access even if it shared its IP address with many others. Or have I misunderstood? Francis -- Francis Davey From ukcrypto at originalthinktank.org.uk Sun Jun 17 17:49:08 2012 From: ukcrypto at originalthinktank.org.uk (Chris Salter) Date: Sun, 17 Jun 2012 17:49:08 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <4FDDEA59.2010709@originalthinktank.org.uk> References: <4FDDEA59.2010709@originalthinktank.org.uk> Message-ID: <4FDE0A84.7000002@originalthinktank.org.uk> On 17/06/2012 07:48, Alec Muffett wrote: > MITM can sometimes be found out nowadays because a small number of > people are running technologies like Convergence > (See:http://www.youtube.com/watch?v=Z7Wl2FW2TcA - I consider this a > must-see video for the perspective it imparts) which eschews the > trust model of Certificate Authorities in favour of a real-time check > that the certificate you see for GMail in the UK is the same as is > presented in the USA, Canada, Finland, Russia, Brazil? i.e.: that > nobody is lying to you without lying to them as well. Many many thanks for that; video definitely a 'must-see'! Well worth 48 minutes of anyone's time. Regards to All, Chris -- Chris Salter http://www.originalthinktank.org.uk/ http://www.post-polio.org.uk/ From chris-ukcrypto at lists.skipnote.org Sun Jun 17 17:58:33 2012 From: chris-ukcrypto at lists.skipnote.org (Chris Edwards) Date: Sun, 17 Jun 2012 17:58:33 +0100 (BST) Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk>

Message-ID: On Sun, 17 Jun 2012, Francis Davey wrote: > That is very interesting. Does that mean that s97A (anti-copyright > infringement) ordered blocks could be required to block a particular > hostname without having to look inside the http packet, but merely at > the TLS client HELLO (or does that count as DPI - I'm never sure what > counts as "deep")? I'm not sure what counted as "deep" either, but this new bill seems to be changing things, such that you intercept content using DPI kit to extract certain info, which is then deemed mere "traffic data". Sniffing the URL hostname from the a TLS connection would probably count as an example of this. Although most current browsers do SNI, not all do. Because of this, the majority of web hosters still use a unique IP address for every https website, just like they always did. So in most (current) cases, blocking an https site by IP address would not result in overblocking. That might change in future if web hosts start putting multiple websites on a single IP (and using the SNI in anger). So any web-blocking system would need to examine the SNI, and I'm not sure if such kit exists (today). From lists at internetpolicyagency.com Sun Jun 17 17:57:41 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Sun, 17 Jun 2012 17:57:41 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <4FDE04AF.5000903@zen.co.uk> References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk> <4FDE04AF.5000903@zen.co.uk> Message-ID: In article <4FDE04AF.5000903 at zen.co.uk>, Peter Fairbrother writes >I think the browsers are looking to check the hostname in the requested >URL matches the hostname in the certificate - and it doesn't, >65.55.25.59 != www.update.microsoft.com > >Both actions seem like perfectly good behaviour to me. As a "user" I'd expect the browser to connect the two concepts, it's not as if DNS hasn't been invented yet. -- Roland Perry From zenadsl6186 at zen.co.uk Sun Jun 17 18:58:38 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sun, 17 Jun 2012 18:58:38 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk> <4FDE04AF.5000903@zen.co.uk> Message-ID: <4FDE1ACE.4070604@zen.co.uk> Roland Perry wrote: > In article <4FDE04AF.5000903 at zen.co.uk>, Peter Fairbrother > writes >> I think the browsers are looking to check the hostname in the >> requested URL matches the hostname in the certificate - and it >> doesn't, 65.55.25.59 != www.update.microsoft.com >> >> Both actions seem like perfectly good behaviour to me. > > As a "user" I'd expect the browser to connect the two concepts, it's not > as if DNS hasn't been invented yet. Let me rephrase that - they seem like secure behaviour. Mismatches between hostname strings in requested URLS and hostname strings in certificates are probably the most common cause of false positive security alerts in browsers - witness the recent "Query on security certificates (possibly OT)" thread here - but I can think of no other realistic and secure way than to ensure that the strings match, and that the certificate owner is who the user thinks he is. And it's solely up to the website owner to ensure that the strings match - - if he links to a page named "trading.ANONYMISED.co.uk" rather than "www.ANONYMISED.co.uk" then he only has himself to blame if we think his coders cannot be properly security-minded if they made that kiddy mistake, - and moreover, if we wonder at how this update could have been committed when it was in such an untested state as to produce certificate warnings. -- Peter F From zenadsl6186 at zen.co.uk Sun Jun 17 18:59:15 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sun, 17 Jun 2012 18:59:15 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk>

Message-ID: <4FDE1AF3.60302@zen.co.uk> Chris Edwards wrote: > On Sun, 17 Jun 2012, Francis Davey wrote: > >> That is very interesting. Does that mean that s97A (anti-copyright >> infringement) ordered blocks could be required to block a particular >> hostname without having to look inside the http packet, but merely at >> the TLS client HELLO (or does that count as DPI - I'm never sure what >> counts as "deep")? > > I'm not sure what counted as "deep" either, but this new bill seems to be > changing things, such that you intercept content using DPI kit to extract > certain info, which is then deemed mere "traffic data". Sniffing the > URL hostname from the a TLS connection would probably count as an example > of this. Probably OK under the present RIPA regime too. > > Although most current browsers do SNI, not all do. Because of this, the > majority of web hosters still use a unique IP address for every https > website, just like they always did. So in most (current) cases, blocking > an https site by IP address would not result in overblocking. > > That might change in future if web hosts start putting multiple websites > on a single IP (and using the SNI in anger). So any web-blocking system > would need to examine the SNI, and I'm not sure if such kit exists > (today). With the introduction of IPv6 any pressure to share IPs will most likely go away, and I suspect SNI will never really get used in anger. In fact it might be a good idea to deprecate it, starting sooner rather than later. Hmm, is it easy to switch off in ordinary browsers? Not that it's that much of a security risk, just that it's a not-very-good idea whose only function is to overcome a now-vanishing problem. -- Peter Fairbrother > > > From ben at links.org Sun Jun 17 19:08:01 2012 From: ben at links.org (Ben Laurie) Date: Sun, 17 Jun 2012 19:08:01 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <8A00991A-2B69-4360-BA6D-185FD37ACEC9@gmail.com> References: <8A00991A-2B69-4360-BA6D-185FD37ACEC9@gmail.com> Message-ID: On Sun, Jun 17, 2012 at 7:48 AM, Alec Muffett wrote: > Ben Laurie / Google also have some ideas towards some of the same risks (http://www.imperialviolet.org/2011/11/29/certtransparency.html) - my personal opinion of which is that they have a point but their threat model does not take adequate consideration of state-based MITM; How so? From zenadsl6186 at zen.co.uk Sun Jun 17 19:08:48 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sun, 17 Jun 2012 19:08:48 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk>

Message-ID: <4FDE1D30.4040000@zen.co.uk> Chris Edwards wrote: > I'm not sure what counted as "deep" either, but this new bill seems to be > changing things, such that you intercept content using DPI kit to extract > certain info, which is then deemed mere "traffic data". But if you are looking for "traffic data" then that's not "intercepting content". @cos it's defined that way. @cos that's how we defined it, MHYA -NYHA-NYHAAA! -- Peter F RIPA 2(5) From tony.naggs at googlemail.com Sun Jun 17 19:11:23 2012 From: tony.naggs at googlemail.com (Tony Naggs) Date: Sun, 17 Jun 2012 19:11:23 +0100 Subject: ACM Turing 100 year anniversary - panel on Information, Data Security, in a Networked Future Message-ID: Hi The US ACM (Association for Computing Machinery) held a big A.M. Turing 100th birthday event this weekend, the webcast on Security is now available and may be interesting to some UKcrypto readers. The panel are making interesting comments on the simplicitly versus complexity of computing devices, the hundreds of certificate authorities trusted by default by most PCs, ... Webcasts: http://turing100.acm.org/index.cfm?p=webcast (The Security panel is currently the last webcast in the menu I see.) Panel details: Information, Data, Security in a Networked Future Chair: Vint Cerf Panel: John Hopcroft, Bob Kahn, Ron Rivest, Adi Shamir Abstract The digital information revolution begins as giants such as Alan Turing, Claude Shannon and John von Neumann, among many others, recognize the power of digital representations and programmable computers. Although rooted in the technology of his time, Vannevar Bush's portrait of the information revolution has emerged and flourished especially in the form of the World Wide Web resting atop the global Internet. The panelists will explore some specifics of the digital information revolution, notably theory and practice in securing, authenticating and maintaining the integrity of information (Cerf); and roots of modern cryptography and current topics in this area (rivest and Shamir). They will also gain insight into the long-term problem of identifying, fi nding, and assuring the integrity of digital objects in the most general sense of that term (Kahn). Finally, they look at how our understanding of computer science is changing (Hopcroft) and how that evolution will affect the digital world in which are we spending an increasing fraction of our daily lives. -------------- next part -------------- An HTML attachment was scrubbed... URL: From ben at links.org Sun Jun 17 19:18:39 2012 From: ben at links.org (Ben Laurie) Date: Sun, 17 Jun 2012 19:18:39 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk>

Message-ID: On Sun, Jun 17, 2012 at 5:58 PM, Chris Edwards wrote: > On Sun, 17 Jun 2012, Francis Davey wrote: > >> That is very interesting. Does that mean that s97A (anti-copyright >> infringement) ordered blocks could be required to block a particular >> hostname without having to look inside the http packet, but merely at >> the TLS client HELLO (or does that count as DPI - I'm never sure what >> counts as "deep")? > > I'm not sure what counted as "deep" either, but this new bill seems to be > changing things, such that you intercept content using DPI kit to extract > certain info, which is then deemed mere "traffic data". ?Sniffing the > URL hostname from the a TLS connection would probably count as an example > of this. > > Although most current browsers do SNI, not all do. ?Because of this, the > majority of web hosters still use a unique IP address for every https > website, just like they always did. ?So in most (current) cases, blocking > an https site by IP address would not result in overblocking. > > That might change in future if web hosts start putting multiple websites > on a single IP (and using the SNI in anger). ?So any web-blocking system > would need to examine the SNI, and I'm not sure if such kit exists > (today). Marsh Ray has a proposal to encrypt extensions. Unfortunately the version that encrypts SNI takes an extra round trip. http://tools.ietf.org/html/draft-ray-tls-encrypted-handshake-00 > > From jon+ukcrypto at unequivocal.co.uk Sun Jun 17 18:43:34 2012 From: jon+ukcrypto at unequivocal.co.uk (Jon Ribbens) Date: Sun, 17 Jun 2012 18:43:34 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk> <4FDE04AF.5000903@zen.co.uk> Message-ID: <20120617174334.GO5499@snowy.squish.net> On Sun, Jun 17, 2012 at 05:57:41PM +0100, Roland Perry wrote: > In article <4FDE04AF.5000903 at zen.co.uk>, Peter Fairbrother > writes >> I think the browsers are looking to check the hostname in the requested >> URL matches the hostname in the certificate - and it doesn't, >> 65.55.25.59 != www.update.microsoft.com >> >> Both actions seem like perfectly good behaviour to me. > > As a "user" I'd expect the browser to connect the two concepts, it's not > as if DNS hasn't been invented yet. It would be a security hole if it worked as you suggest - the whole point of SSL is that you can know who you're talking to (and that you can't be overheard). How many users are going to know that "65.55.25.59" is who they want to talk to, and "65.22.25.59" is not? It's bad enough already with hostnames that look similar! From zenadsl6186 at zen.co.uk Sun Jun 17 22:32:46 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sun, 17 Jun 2012 22:32:46 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <4FDE0A84.7000002@originalthinktank.org.uk> References: <4FDDEA59.2010709@originalthinktank.org.uk> <4FDE0A84.7000002@originalthinktank.org.uk> Message-ID: <4FDE4CFE.9060102@zen.co.uk> Chris Salter wrote: > On 17/06/2012 07:48, Alec Muffett wrote: >> MITM can sometimes be found out nowadays because a small number of >> people are running technologies like Convergence >> (See:http://www.youtube.com/watch?v=Z7Wl2FW2TcA - I consider this a >> must-see video for the perspective it imparts) which eschews the >> trust model of Certificate Authorities in favour of a real-time check >> that the certificate you see for GMail in the UK is the same as is >> presented in the USA, Canada, Finland, Russia, Brazil? i.e.: that >> nobody is lying to you without lying to them as well. > > Many many thanks for that; video definitely a 'must-see'! Well worth 48 > minutes of anyone's time. For the first 38 minutes, very much so. After that he start promoting his solution, which afaict doesn't actually work - but he does seem to have a much better grasp of the problem than most. The idea of consulting your chosen authority, rather than those hardwired into your web browser, ... well. maybe. Or maybe not. It does seem attractive. At least it's different, but is it actually any better? -- Peter Fairbrother From alec.muffett at gmail.com Sun Jun 17 22:38:21 2012 From: alec.muffett at gmail.com (Alec Muffett) Date: Sun, 17 Jun 2012 22:38:21 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <4FDE4CFE.9060102@zen.co.uk> References: <4FDDEA59.2010709@originalthinktank.org.uk> <4FDE0A84.7000002@originalthinktank.org.uk> <4FDE4CFE.9060102@zen.co.uk> Message-ID: <452EC79E-0FBD-44E9-A911-0D13C5BEECA8@gmail.com> On 17 Jun 2012, at 22:32, Peter Fairbrother wrote: > At least it's different, but is it actually any better? I use the word "complementary". -a From zenadsl6186 at zen.co.uk Sun Jun 17 22:58:31 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Sun, 17 Jun 2012 22:58:31 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <452EC79E-0FBD-44E9-A911-0D13C5BEECA8@gmail.com> References: <4FDDEA59.2010709@originalthinktank.org.uk> <4FDE0A84.7000002@originalthinktank.org.uk> <4FDE4CFE.9060102@zen.co.uk> <452EC79E-0FBD-44E9-A911-0D13C5BEECA8@gmail.com> Message-ID: <4FDE5307.7000304@zen.co.uk> Alec Muffett wrote: > On 17 Jun 2012, at 22:32, Peter Fairbrother wrote: > >> At least it's different, but is it actually any better? > > I use the word "complementary". > > Well yes, but any kind of "you can use it alongside the regular method" method should work just fine on it's own. :) From igb at batten.eu.org Sun Jun 17 19:42:26 2012 From: igb at batten.eu.org (Ian Batten) Date: Sun, 17 Jun 2012 19:42:26 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <41EA8ACD0D8C4DCC86C7D902FEEFBF7E@your41b8d18ede> References:

<41EA8ACD0D8C4DCC86C7D902FEEFBF7E@your41b8d18ede> Message-ID: On 17 Jun 2012, at 14:58, Tom Thomson wrote: >> http://www.complicity.co.uk/blog/2012/06/spooks-in-the-middle/ >> >> I personally think it unlikely the UK govt would be stupid enough to try >> this. If they want data on encrypted communications, I think it's more >> likely they'd use legislation to get Facebook / Twitter to store and hand >> over the data of UK users. Assuming these companies wish to have an >> office in the UK, they would presumably have no choice but to comply. >> >> However, as I understand it, this Bill allows for both possibilities. > > Getting third parties to store this data and make hand it over might be rather difficult. But clearly not impossible. http://www.google.com/transparencyreport/userdatarequests/ ian From colinthomson1 at o2.co.uk Mon Jun 18 00:55:15 2012 From: colinthomson1 at o2.co.uk (Tom Thomson) Date: Mon, 18 Jun 2012 00:55:15 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: References:

<41EA8ACD0D8C4DCC86C7D902FEEFBF7E@your41b8d18ede> Message-ID: <4752CBF0BEC84A4397A927653F246745@your41b8d18ede> > > Getting third parties to store this data and make hand it over might be > rather difficult. > > But clearly not impossible. > http://www.google.com/transparencyreport/userdatarequests/ > > ian I agree, it's not going to be impossible for all requests made to all social networking sites. But that doesn't mean that it is possible for all requests to all social networking sites, or that it will be equally easy/difficult/impossible for social networking sites based in different countries. For example the Google figures you reference show that a significant proportion of requests are not complied with; for example only 63% of the UK's requests for data were complied with in whole or in part. Using social networking sites whose servers are in Scandinavia might be an interesting option. I must see if I can find a suitable pod in Denmark or in Norway - I suspect there's a fair chance that would make getting the data impossible. And it remains to be seen whether what this bill claims is comms data is indeed comms data according to the relevant EU directives - I suspect that will need testing in court, and will fail if the UK definitions allow the authorities to discover recipients of every communication (because that would amount to knowing who has accessed a particular resource, not just who has accessed a particular website, and surely the uri beyond the first "/" is not comms data). M. From tony.naggs at googlemail.com Mon Jun 18 01:12:28 2012 From: tony.naggs at googlemail.com (Tony Naggs) Date: Mon, 18 Jun 2012 01:12:28 +0100 Subject: scary certificate for www.update.microsoft.com Message-ID: On 17 June 2012 17:57, Roland Perry wrote: > In article <4FDE04AF.5000903 at zen.co.uk>, Peter Fairbrother < > zenadsl6186 at zen.co.uk> writes > > I think the browsers are looking to check the hostname in the requested >> URL matches the hostname in the certificate - and it doesn't, 65.55.25.59 >> != www.update.microsoft.com >> >> Both actions seem like perfectly good behaviour to me. >> > > As a "user" I'd expect the browser to connect the two concepts, it's not > as if DNS hasn't been invented yet. > Scary certificate test results for Microsoft's Update server SSL certificate - "Overall rating Zero": As assessed by https://www.ssllabs.com/ssltest/analyze.html?d=www.update.microsoft.com Several bad features get highlighted in red. Certificate Information Common names www.update.microsoft.com Alternative names - Prefix handling Not required for subdomains Valid from Thu May 31 04:36:05 UTC 2012 Valid until Sat Aug 31 04:46:05 UTC 2013 (expires in 1 year and 2 months) Key RSA / 2048 bits Signature algorithm SHA1withRSA Server Gated Cryptography No Weak key (Debian) No Issuer Microsoft Update Secure Server CA 1 Next Issuer Microsoft Root Certificate Authority Chain length (size) 2 (3241 bytes) Chain issues Incomplete Extended Validation No Revocation information CRL Revocation status Unchecked (only trusted certificates can be checked) Trusted No NOT TRUSTED (Why?) Protocols TLS 1.2 No TLS 1.1 No TLS 1.0 Yes SSL 3.0 Yes SSL 2.0+ upgrade support Yes SSL 2.0 INSECURE Yes Cipher Suites (SSLv3+ suites in server-preferred order, then SSLv2 suites where used) TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128 TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256 TLS_RSA_WITH_RC4_128_SHA (0x5) 128 TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 168 TLS_RSA_WITH_RC4_128_MD5 (0x4) 128 SSL_DES_192_EDE3_CBC_WITH_MD5 (0x700c0) 168 SSL_RC4_128_WITH_MD5 (0x10080) 128 Miscellaneous Test date Sun Jun 17 22:52:25 UTC 2012 Test duration 22.40 seconds Server signature Microsoft-IIS/7.0 Server hostname - Session resumption No (IDs assigned but not accepted) BEAST attack Vulnerable INSECURE (more info) Secure Renegotiation Supported, with client-initiated renegotiation disabled Insecure Renegotiation Not supported Strict Transport Security No TLS version tolerance 0x0304: 0x301; 0x0399: 0x301; 0x0499: 0x301 PCI compliant No FIPS-ready No Ephemeral DH Not seen -------------- next part -------------- An HTML attachment was scrubbed... URL: From fw at deneb.enyo.de Sun Jun 17 22:27:12 2012 From: fw at deneb.enyo.de (Florian Weimer) Date: Sun, 17 Jun 2012 23:27:12 +0200 Subject: https - hopefully not too stupid a question In-Reply-To: <4FDE1AF3.60302@zen.co.uk> (Peter Fairbrother's message of "Sun, 17 Jun 2012 18:59:15 +0100") References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk>

<4FDE1AF3.60302@zen.co.uk> Message-ID: <87pq8xiq8f.fsf@mid.deneb.enyo.de> * Peter Fairbrother: > With the introduction of IPv6 any pressure to share IPs will most > likely go away, and I suspect SNI will never really get used in anger. IPv6 does not mean that the network will provision multiple addresses to you. You will still have to pay extra for that. From ben at links.org Mon Jun 18 05:04:58 2012 From: ben at links.org (Ben Laurie) Date: Mon, 18 Jun 2012 05:04:58 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <4FDDE256.6000509@zen.co.uk> References: <4FDDE256.6000509@zen.co.uk> Message-ID: On Sun, Jun 17, 2012 at 2:57 PM, Peter Fairbrother wrote: > Francis Davey wrote: >> >> This is the first question I have initiated on this group, so I hope >> it does not seem to be too foolish a query. >> >> Reading: >> >> http://fsfe.org/news/2012/news-20120616-01.html >> >> I wondered to what extent the government could put a framework in >> place to avoid some of these, in particular the use of https. Could >> the government set things up within the UK so that certificates were >> forged so that they were able to intercept https in transit? > > > Yes, but they would get caught if they did it surreptitiously and often. > > Either by certificate comparisons performed by the occasional nerd or > security company, or by the black boxes at the ISPs - a black box which > simply acts as a tap on the line would have different traffic > characteristics, which the ISP would notice, as they measure traffic for > peering and payment purposes. > > There are a couple of other ways they might get caught too. > > >> Assume that the Bill gives them the legal power to require anyone in >> the UK to do anything in order to facilitate obtaining comms data >> could they use that power to require someone/anyone to issue >> certificates purporting to be for sites (like facebook)? I am not sure >> how easy it is for a state actor to do this in a way that will affect >> ordinary people. > > > Once caught, the offending certificate could be traced to the issuing CA, > who would then risk getting excluded from the major browser's "trusted CA" > lists - death for a CA. > > > > > Something perhaps much more interesting, in the Chinese proverbial sense of > the word, ?would be for the gubbmint to obtain the private keys for the > websites visited. Once they have those they can easily work out the session > keys used just from looking at traffic, without modifying it (unless a DHE > SSL/TLS suite [1] is used). > > They could demand the keys from the websites, if they have a UK presence, > under RIPA part 3 (if the keys are dual-purpose, ie used to establish the > session key as well as for authentication, which they very often are) - or > perhaps under this new Act under some more general power. > > [1] a DHE suite uses Diffie-Hellman to establish an Ephemeral session key > which cannot be worked out from looking at traffic, or through subsequent > demands for keys. > > Each party creates an ephemeral secret (they generate a random number and > keep it secret), and the shared secret session key is worked out from them > using some clever mathematrickery without exposing those secrets in > transmission. The secrets are then discarded, and the session is (should be > ) discarded after the session. > > There are DH suites which are not ephemeral (the server resuses the same > secret for all sessions, and does not delete it) - in those cases the > session keys can be worked out if the secret is made known, by demand or > otherwise. > > >> >> I'm not interested in whether the technically savvy are able to avoid >> such action - let us stipulate for the sake of argument that they are. > > > For nerds, they might be able to discourage the use of DHE suites ( by > replacing a small bit of traffic saying "I don't do that DHE suite, try this > non-DHE one instead" when establishing which suite to use at the beginnning > of a session. If they can do that, then they might as well just mitm the whole session, which DHE will not defend against. > > That also would be found out, but it would take longer and there wouldn't be > such a big "smoking gun" as in a forged certificate MITM attack. > > > -- Peter Fairbrother > >> >> Thanks. >> > > From alec.muffett at gmail.com Mon Jun 18 05:13:15 2012 From: alec.muffett at gmail.com (Alec Muffett) Date: Mon, 18 Jun 2012 05:13:15 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <87pq8xiq8f.fsf@mid.deneb.enyo.de> References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk>

<4FDE1AF3.60302@zen.co.uk> <87pq8xiq8f.fsf@mid.deneb.enyo.de> Message-ID: <80A574FE-2F3F-474F-A5A9-DA9BC7FC0EB2@gmail.com> On 17 Jun 2012, at 22:27, Florian Weimer wrote: > IPv6 does not mean that the network will provision multiple addresses > to you. You will still have to pay extra for that. Actually it's exactly the point; over on ORG-discuss an ISP guy who does this says: > Most ISP's will be assigning IPv6 addresses by prefix, > RIPE suggests /56, or in the smallest instance /64. Although machines > can choose their own address from that range, the prefix will be the > same, so the assigning ISP only has to log the prefix that user has > been assigned (and the times it has been assigned), which is not > significantly more difficult or space consuming that logging the > assignment of IPv4 addresses. > > Disclosure: I recently implemented the IPv6 assignment and logging > back-end system for the ISP I work for. ?and... > The ISP I work for will be assigning /56's, or in some cases a /64. > RIPE guidlines say a /64 is the smallest assignment that can be made > to an end user. ?which will give each user's home 2^64 reachable IP addresses. Of course the ISP is free to charge what they like for this service, but the suggestion is that NAT goes away and every device in your home is will be internet-reachable unless filtered/firewalled. -a From fw at deneb.enyo.de Mon Jun 18 06:36:57 2012 From: fw at deneb.enyo.de (Florian Weimer) Date: Mon, 18 Jun 2012 07:36:57 +0200 Subject: https - hopefully not too stupid a question In-Reply-To: <80A574FE-2F3F-474F-A5A9-DA9BC7FC0EB2@gmail.com> (Alec Muffett's message of "Mon, 18 Jun 2012 05:13:15 +0100") References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk>

<4FDE1AF3.60302@zen.co.uk> <87pq8xiq8f.fsf@mid.deneb.enyo.de> <80A574FE-2F3F-474F-A5A9-DA9BC7FC0EB2@gmail.com> Message-ID: <87vcipuqo6.fsf@mid.deneb.enyo.de> * Alec Muffett: > On 17 Jun 2012, at 22:27, Florian Weimer wrote: > >> IPv6 does not mean that the network will provision multiple addresses >> to you. You will still have to pay extra for that. > > Actually it's exactly the point; over on ORG-discuss an ISP guy who does this says: [snip] > ?which will give each user's home 2^64 reachable IP addresses. Not in datacenters, where you'd typically have machines which run data centers. With IPv4, most hosters tell you to configure a /24 netmask on your interface. But this doesn't mean that you'll be able to use more than the one IPv4 address the network has handed to you. With IPv6, there are still technical reasons for limits, although addresses aren't scarce: each address requires precious TCAM space, and neighbor discovery does not work at scale. From alec.muffett at gmail.com Mon Jun 18 06:49:31 2012 From: alec.muffett at gmail.com (Alec Muffett) Date: Mon, 18 Jun 2012 06:49:31 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <87vcipuqo6.fsf@mid.deneb.enyo.de> References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk>

<4FDE1AF3.60302@zen.co.uk> <87pq8xiq8f.fsf@mid.deneb.enyo.de> <80A574FE-2F3F-474F-A5A9-DA9BC7FC0EB2@gmail.com> <87vcipuqo6.fsf@mid.deneb.enyo.de> Message-ID: On 18 Jun 2012, at 06:36, Florian Weimer wrote: > Not in datacenters, where you'd typically have machines which run data > centers. ...I am familiar with the whir of the fans, the whine of the UPS and the dangers of halon and an unprotected BRS, they haunt my dreams; Cisco and Juniper switches lollop through my nightmares as I try to recall the labyrinthine double negative syntax of "unset nononopoweroffnoreally" to shut them down... > With IPv4, most hosters tell you to configure a /24 netmask > on your interface. But this doesn't mean that you'll be able to use > more than the one IPv4 address the network has handed to you. Mmph. Actually I have a /29 at home which nominally would provide me with 5 routable addresses + 1 router address + broadcast and network address, and therefore I've had to set my internet-side net mask to 255.255.255.248; I rather think that if I set it to reflect a /24 this might cause some upset upstream. Within my home network I have three /24s, yes, obviously, because you can - but that's because I'm insulated by NAT. If/when my ISP give me a IPv6 /64 to fart around with, I shall take great delight in hosting a web server on my phone. > With IPv6, there are still technical reasons for limits, although > addresses aren't scarce: each address requires precious TCAM space, > and neighbor discovery does not work at scale. Fine. So my IPv6 neighbours are in my home. Just route to it. :-) -a From lists at internetpolicyagency.com Mon Jun 18 07:28:40 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Mon, 18 Jun 2012 07:28:40 +0100 Subject: scary certificate for www.update.microsoft.com In-Reply-To: References: Message-ID: In article , Tony Naggs writes >Scary certificate test results for Microsoft's Update server SSL certificate As I hinted yesterday, I had only gone to the site because I'd read reports about it. (And I needed an example of an https url, and that one was handy). Here's a different diagnostic tool: http://www.sslshopper.com/ssl-checker.html#hostname=www.update.microsoft.com -- Roland Perry From lists at internetpolicyagency.com Mon Jun 18 07:44:29 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Mon, 18 Jun 2012 07:44:29 +0100 Subject: scary certificate for www.update.microsoft.com In-Reply-To: References: Message-ID: And here's a blog fresh off the press: http://unmitigatedrisk.com/?p=116 But I have one issue with the author. He writes: I think it?s probably legitimate to use another browser to download patches. However: 1) Microsoft has long said that you can only use their own browser to download updates (or a browser that claims to be theirs). 2) Their update site no longer downloads patches. Yes, that's right. All it has is a message saying "please use your Windows Control Panel" [instead]. -- Roland Perry From lists at internetpolicyagency.com Mon Jun 18 08:50:57 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Mon, 18 Jun 2012 08:50:57 +0100 Subject: https - hopefully not too stupid a question In-Reply-To: <87vcipuqo6.fsf@mid.deneb.enyo.de> References: <4FDDE873.8020906@zen.co.uk>

<4FDDF8D7.7080108@zen.co.uk>