Strategies for preventing man-in-the-middle attacks

Many activists in some countries are having their SSL connections intercepted by their own ISP's, under orders from their governments. I have been a bit of a political activist in the past in one of those countries. So man-in-the-middle attacks on my internet connections are a possibility. Unlikely, but possible.

One strategy to counter mitm attacks is to tunnel through a free VPN. But in the path from the exit of the tunnel to the site being visited a man-in-the-middle scheme is still possible.

Is it possible to connect to a site several times simultaneously through different free VPN tunnels, and only trust you are connecting to the right site if all the connections are identical in terms of the certificates they present? That would be a cool firefox addon.

 

When you browse to a site, examine the certificate details before continuing. If the whole certificate chain looks good, and ends on a reputable certificate authority, you should be good.

 

Any strategies less reliant on personal judgement?

Also, I have the impression the whole design with certificate authorities is broken, or rather deliberately made such that interception by corrupt governments is possible, and that is why some people recommend other means of certificate sharing that do not involve authorities but trusted friends and contacts.

 

Hmm interesting question. Well if a certificate authority is hacked to steal their root private key, or the private key of an intermediate CA, then you are really pwnd. Especially if done by a government that can intercept all traffic. The same goes for weak keys that can be broken by govt supercomputers.

Maybe a group could carefully maintain a list of known authentic website certificates. Once a websites certificate is verified by some manual process it is added to the list. When browsing to that site, the cert presented is compared to the list. If it matches you are good. If a site updates its cert, it would have to be reverified.

It would be impractical for general browsing, but feasible if you just wanted to be safe for a handful of sites. The challenge then would be distribution of a certificate that authenticates access to the list itself, and protection of the list.

 

This thread is just a reminder of how bad we need major changes in security authorization/authentication. Time is ticking.

 

So it boils down to how you get the certificates the first time. Maybe this first time can be from an internet cafe or a wifi hotspot or a public library etc instead of your home?

And since the first time occurs over and over and over because certificates expire... maybe if you could find a way to be present at all those internet access points at the same time?

 

Yeah the more you think about it, the harder it seems. I don't see how using a public access point would be better than home unless an organization is explicitly targeting you. If a govt wanted to MITM people to watch what is happening, it would put its hooks very high upstream to not let anyone through the cracks. You would have to spread out across different countries.

 

If your government has MITM certs they can decrypt the information anywhere. The only protection I can think of is to send sensitive files that you encrypt locally as a means to communicate. At that point you can establish a password in person or through some other means.

 

HTTPS Everywhere has an SSL Observatory

 

So it is not too hard for a govt to MITM the entire country, absolutely all SSL connections to be intercepted? I was counting on them not having the resources to do that. What resources are required for such a thing?

 

Ok. Would I be counting on the download of the Perspectives addon not having been intercepted, and also the download of firefox from the distro repos not having been intercepted?

 

Well basically they just need control of all the ISPs in the country. Or they could get higher if there are a few relay hubs that all the ISPs use.

 

Agreed, but it is feasible to think they could monitor just a handful of sites they care about, or tamper with a handful of the authentication programs you mentioned. But there is just too many to believe they could subvert them all.

 

Aside from the certainty that governments will get caught eventually if they massively modify downloads therefore they will never do this massively, what about abusing the certificate authority design on a large scale and only for eavesdropping purposes, never modifying data?

Technically, does it require too much processing power to intercept and eavesdrop all ssl connections going through a national backbone if such a thing exists in a country?

 

Well, they could only eavesdrop ssl connections for sites that they have keys for. Or they could be MITMing you. In either case, they wouldn't do it for EVERY site, just the ones they cared about. I honestly have no idea how much processing power they would have/need to do on a national level.

 

Apologies for the gaps in my understanding of authorization. Returning to select individuals being targeted for MITM through their ISP's, which of the following two is a better defence for such individuals?

Strategy A:
Install Perspectives, stay home, believe connection to notaries cannot be intercepted or fake notaries presented, trust the real notaries are telling the truth, watch for any warnings from Perspectives or browser

Strategy B:
Install Perspectives, visit HTTPS site from wifi hotspot 1, visit same HTTPS site from wifi hotspot 2, visit same site from home, watch for any warnings from Perspectives or browser

 

Personally, I would go stategy A. Maybe do some work up front to make sure your authentication software looks good, and maybe install 1 or 2 others to be sure you didn't get the 1 that the govt did subvert.

After that you are probably good.

However if the govt was actually targeting you, you would have to assume your computers were already trojaned.

 

All I do is CTRL I in FF, look at the Security tab then view the cert, so what is this cert chain you are talking about?

 

One more question. The Perspectives icon sometimes becomes a cross and then selecting "View Notary Results" I get that

"Perspectives has not seen this certificate consistently"



Does not having seen the certificate consistently mean that this site has been MITM'ed before? If so, how do I know it is not MITM'ed now?

 

When you view the cert, there should be a details tab. Click it and it will show you the whole certificate chain. The top is the root, and the bottom is the cert for the site.