[DethNinja]

In my opinion, most of the governments must have obtained access to numerous Certificate Authority private keys by now. As a result, they would not only be logging DNS records but also the entire unencrypted data transfer.

I think lesson to be learned here is that centralized systems such as the internet, due to CAs (including Cloudflare) and ISPs, are unsuitable for private communications.

It is so sad that so many people won't experience late 1980s and early 1990s era of the internet, which was devoid of extensive surveillance and censorship.

Hopefully, humanity will somehow figure out a superior, decentralized communications platform to ensure privacy. However, the current internet offers no such guarantees.

My recommendation at this stage is to assume that government and supranational organizations control the entirety of the internet and act accordingly as if internet had no privacy.

[Deathmax]

> In my opinion, most of the governments must have obtained access to numerous Certificate Authority private keys by now. As a result, they would not only be logging DNS records but also the entire unencrypted data transfer.

Certificate Transparency ensures that having control over a Certificate Authority's private keys doesn't allow for undetectable MITM attacks since both Chrome [1] and Apple (Safari) [2] will not trust certificates that have not been submitted to CT logs and stamped as such. If a government attempts to issue a trusted certificate using a CA they control, it will be logged. You can't passively decrypt TLS connections with just access to a CA's private keys since those aren't the keys involved in communication, or even the server's private key due to forward secrecy (assuming modern TLS configs).

[1]: https://groups.google.com/a/chromium.org/g/ct-policy/c/wHILi...

[2]: https://support.apple.com/en-gb/HT205280

[vlod]

For those interested in CTLogs [0].

FTL:

>Firefox does not currently check or require the use of CT logs for sites that users visit.

Uggh... Anyone know why? Seems sensible to check.

[0]: https://developer.mozilla.org/en-US/docs/Web/Security/Certif...

[samwillis]

If they had compromised root keys, then they still need to MITM the connection in order to provide a fake certificate. This would be detectable, and there has been no evidence of it happening, so I'm sceptical its happened in any significant way. If it was widespread, and not just very targeted, we would know about it.

A government agency using a root key, and getting spotted, would be disastrous for everyone, themselves included. So, if they do have them, and I think you are probably right to assume they do, they would only use them as a last resort in incredibly extreme cases. It would not surprise me if they have have them but have never used them.

[tailspin2019]

> ... they still need to MITM the connection ... and there has been no evidence of it happening

Because the parent you're replying to seems to be talking about any/all governments rather than just the UK, and I'm guessing your statement here was 'scoped' to the UK only - I think it's important to point out that this absolutely HAS happened on multiple occasions outside of the UK.

https://en.greatfire.org/blog/2013/jan/china-github-and-man-...

https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai...

https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att...

[jjoonathan]

Yes, and they don't need to decrypt everything because of how good metadata is. Remember: we kill people based on metadata.

[jchw]

> As a result, they would not only be logging DNS records but also the entire unencrypted data transfer.

Note that even if you have the private key for a specific certificate, you still cannot perform a passive MitM attack against servers that use modern TLS using perfect forward secrecy, and active MitM attacks can sometimes be detected by the web server itself. There are different techniques that have cropped up; here's an old doc page about Caddy v1, mainly because it's the one that I remembered first:

https://caddy.its-em.ma/v1/docs/mitm-detection

That said, as others have mentioned, CT logs basically foil direct man-in-the-middle attacks abusing CA certificates. The attack will work, assuming it isn't foiled by HSTS, but it will be detected. For a government surveillance program, this would obviously be a very bad outcome.

The CA system definitely gets some deserved flak for being flawed, however I've personally found myself impressed with how much practical security against attackers the web ecosystem has managed to build up. It also was probably good to get more of it done ahead of time before governments could try to abuse gaps in the system; as it stands now, if we had DoH and ESNI (edit: or, now, ECH, I suppose) deployed widely across the internet, it would probably render this entire government surveillance operation useless.

[tialaramex]

> but it will be detected. For a government surveillance program, this would obviously be a very bad outcome.

For the NSA that's unacceptable, because the Americans specifically don't like people to know who did it, that's even the point of some big known NSA programmes, like that thing where they hack two Cisco routers so that all the stolen data goes from A to B, but via C, and the NSA steal the data again at C, so when A figure out what's happening they blame B...

But for e.g. the Russians it's totally fine. When you send assassins as "tourists" with a patently bogus reason for travel that's not because you're too stupid to do better, it's because that's all you needed for the mission and you don't care who knows it.

[DethNinja]

But you can just issue an identical certificate to an existing website's certificate via the private key, it doesn't even need to enter to CT logs, it will have 100% identical fingerprint to original certificate, no?

You can then intercept everything through the ISP gateway. It would be theoretically possible to fragment the entire internet this way via coordinating with the ISPs.

[Melatonic]

Or the major DNS providers are just providing the government with the data without the need to MITM the connection.

Major ISP's definitely I feel like would do this. And most people are leaving DNS as default to their ISP (especially on mobile)

[blitzar]

> Major ISP's definitely I feel like would do this

Its litterally the law, they will comply with the law.

[edandersen]

No need for that, just a D notice on Cloudflare and half the internet is decrypted.

[rafale]

Random thought: they can't use the intercepted communication against you in court because it would reveal their capability. But they can use it in an indirect way to target you.

[tremere]

> It is so sad that so many people won't experience late 1980s and early 1990s era of the internet, which was devoid of extensive surveillance and censorship.

Was it though?

[kneebonian]

Check out Freenet my friend. It is exactly like the internet of the 90's in almost every way, with all the good and bad that entails.

[1827163]

Not happy with any overlay network in this day and age, I have a feeling they have all been compromised. One wrong click and the Thought Police will be at your door. Or at least the chilling effect of not knowing whether it's compromised or not is bad enough that it prevents truly free exploration of the network.

We need a one way system such as satellite data broadcasting, which has more than enough bandwidth for a Web 1.0 experience. I had an entire Usenet feed by satellite many many years ago, and it was totally anonymous because it's receive only. We now only have https://blocksat.info/ but hardly anybody uses it.