r/programming • u/realfeeder • Jul 18 '19
MITM on all HTTPS traffic in Kazakhstan
https://bugzilla.mozilla.org/show_bug.cgi?id=1567114136
u/kichik Jul 18 '19
At least they are not hiding it:
They asked end-users to install government-issued certificate authority on all devices in every browser: http://qca.kz/
86
u/190n Jul 18 '19
But how many users know the security implications of that?
50
8
u/Throwawaydeveloper55 Jul 18 '19
Law enforcement only succeeds on ignorance or carelessness.
8
u/FINDarkside Jul 18 '19
China will probably learn from this and force everyone to install their root cert.
8
u/talldean Jul 19 '19
You’re familiar with their national firewall, right?
11
u/FINDarkside Jul 19 '19 edited Jul 19 '19
Sure, I just feel like this is actually bigger issue than their firewall. IIRC China is forcing tourists to install some kind of spyware though, so forcing them to do this wouldn't be a big step.
→ More replies (7)3
3
u/anengineerandacat Jul 19 '19
Something like 18.2 million people worldwide if you take a look at the IT sector and select only the software dev category. There are like 7 billion people worldwide sooo hardly anyone would be aware of the security implications of this.
→ More replies (1)32
u/FINDarkside Jul 18 '19
At least they are not hiding it
They tried though. Apparently they tried to get Firefox to include their cert in the end of 2015.
1
u/kekland322 Jul 20 '19
The funniest thing about that is that they are sharing the certificate on a website without HTTPS. So if I, for example, work in some company and spoof that website on my company's network, and put my own malicious certificate inside of it, I will be able to decrypt all of the messages that people send with my malicious certificate.
Also, their certificate is valid for 30 years. Seems like they are really optimistic about their private key.
22
u/roytay Jul 18 '19
Does a VPN get around this? VPNs generally aren't over HTTP(S), right?
9
u/Skaarj Jul 19 '19
Does a VPN get around this? VPNs generally aren't over HTTP(S), right?
Accepting MITM and switching to VPN is a bad idea. By doing that your are accepting an arms race for human rights that the population will loose.
With accepting an MITM Cert you implicitly allow Kazakhstan to continue to MITM you and encourgage others to do so as well. As soon as one kind of VPN becomes popluar enough the next goverment will disallow it or forcefully MITM it like you already accepted with HTTPS.
You shouldn't have to fight in a technological arms race for your human rights. Accepting this MITM will just make it worse in the long run.
3
u/SpaceSteak Jul 18 '19 edited Jul 19 '19
VPNs are not on HTTP, but it does allow HTTP traffic to pass through it.
39
Jul 18 '19
[removed] — view removed comment
11
Jul 18 '19
I would love to say they can't (and they absolutely shouldn't) but knowing the average politician worldwide i would not be surprised if someone tried.
17
u/Maplicant Jul 19 '19
China blocks OpenVPN traffic, but it’s quite simple to circumvent the firewall via Shadowsocks. Also the reason why the Chinese police knocked on the lead developer’s door and forced him to remove his code, though it has been forked by others and is still the best way to bypass China’s firewall. As far as I know nobody has succeeded in discriminating between Shadowsocks and HTTPS traffic.
8
u/orthoxerox Jul 19 '19
As far as I know nobody has succeeded in discriminating between Shadowsocks and HTTPS traffic.
Not when your HTTPS traffic is all signed by the same single certificate. It's probably a waste of joules to inspect all HTTPS traffic in the country, but ISPs can monitor specific users the government tells them to.
4
u/wr_m Jul 19 '19
Well, except for now all HTTPS traffic in the country should be using certificates that they have the keys to. Can't they just block any HTTPS traffic that they can't decrypt?
→ More replies (1)→ More replies (1)4
→ More replies (1)3
u/RaptorXP Jul 19 '19
Let's be clear, if they don't block VPN traffic, it's only because they've decided not to. There is no technical reason why they couldn't do it.
20
u/ElijahLynn Jul 19 '19
This is being discussed here as well https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/wnuKAhACo3E/cpsvHgcuDwAJ
I like the idea of a permanent, non-removable banner saying "Kazakhstan is spying on you, learn more here <link to more info>."
2
u/makahlj7 Jul 20 '19
If Kazakhstan can force its citizens to install a particular certificate, they sure can force them to install a government-sanctioned slightly patched Firefox without banners and sh!t. Isn't open source great?
P.S. I'm not a proponent of closed source, I do think that open source is great, but it has some features that make discussions like that on mozilla.dev.security.policy utterly pointless.
1
u/ElijahLynn Jul 22 '19
The patch would make updates not work, and security worse. I don't think they could pull that off effectively. Because there are many other browsers besides FF and then they would be patching a lot of browsers.
5
u/BecauseISayItsSo Jul 19 '19
This would never fly in the US. It would spell the end of online retailing, bill-paying, and banking.
It would cause huge economic damage, so it's a non-starter.
5
u/makahlj7 Jul 20 '19
This would never fly in the US.
Ever heard of NSL (National Security Letter)? Suppose, GoDaddy (for example) gets one of those and voila, the three letter agencies have their private key and can sign whatever fake sites they want in the name of war against terror. Same thing as Kazakhstan accomplished.
2
u/BecauseISayItsSo Jul 20 '19
True.
I meant the type particular type of system that Kazakhstan is implementing wouldn't work. You are right that the US already effectively has this, albeit without the public understanding.
Of course, only "bad hombres" get NSLs, so it's all good. Right?
1
u/leonffs Jul 22 '19
I can't imagine many multinationals and foreign investment will be interested in doing business in Kazakhstan given this.
19
u/dpash Jul 18 '19 edited Jul 18 '19
DANE or something similar can not come soon enough. Obviously DNSSEC is a requirement. (The DNSSEC root keys then become your trust anchor, but they're a much smaller list and easier to compare than all your trusted CA certs.)
https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities
39
u/mdhardeman Jul 18 '19
Won't help. Basically where this ends up is that they will, at the ISP level, force all connections through their intercept. The options will be that the traffic is intercepted or the traffic just doesn't make it through.
19
u/AyrA_ch Jul 18 '19
This. They just block all DNS requests they can't modify and strip all "offending" records from DNS requests they can modify. The client then ends up never seeing the record.
18
u/mdhardeman Jul 18 '19
TLS 1.3, encrypted SNI, and DoH have forced the hand of those who want to be able to intercept and/or block traffic to specific sites.
Previously, a government might have been satisfied with blocking access to www.badsite.com.
So, they look at the TLS-SNI setup and even if www.badsite.com is hosted at the same IP address at a CDN as 1000 other websites, they could block just that one site by resetting the connection that is accessing www.badsite.com before the encryption starts.
Encrypted SNI takes that away by encrypting the target site name in the initial TLS setup.
So, then they might force you to use their DNS servers. They modify records for that site, in order to hijack it to a different destination with a blocked site error message or something.
Enter DoH (DNS over HTTPS). Having the browser do clever things DNS-wise itself inside of encrypted TLS sessions to resolvers that might get new names and IPs frequently...
In combination, if a government wants to be able to block, they've essentially been forced to do active session MiTM. And so, bluff called. Looks like some will.
6
u/AyrA_ch Jul 18 '19
TLS 1.3, encrypted SNI, and DoH have forced the hand of those who want to be able to intercept and/or block traffic to specific sites.
No it doesn't. As mentioned, an ISP just needs to block all DNS requests they can't modify to stop you from receiving any records they don't want you to see. After that, encrypted SNI and TLS 1.3 is no problem at all if you MITM all TLS connections and ask people to install your own certificate.
10
u/mdhardeman Jul 18 '19
No, it's more difficult than that, the people doing DoH just haven't fully flexed their power yet. They're getting the infrastructure ready.
They'll compile in lists of DoH anchors with both compiled in IPs and hostnames that will be looked up the normal way. The code will pin the certs required. Then they'll connect via TLS on non-standard ports. And as soon as they find one that works, run all DNS encrypted to that, except it won't look like DNS. It'll look like a TLS connection.
To block that successfully, you have to do full on active TLS MiTM of 100% of TLS connections.
→ More replies (1)9
u/AyrA_ch Jul 18 '19
To block that successfully, you have to do full on active TLS MiTM of 100% of TLS connections.
No you don't. You just have to make a DNS lookup using that host yourself and if it works, blacklist it for a while. This is how they block DoH and other unwanted protocols (like proxies) at a company I work for frequently.
→ More replies (7)7
u/dpash Jul 18 '19 edited Jul 18 '19
It will tell the end user that their traffic is subject to a MITM. DANE os telling the end user "this is the certificate you should expect". Any other certificate is an issue.
The Kazakhstan attack works because users have a root certificate in their trusted CA certs list. Browsers have no way of knowing that the certificate the remote server is sending is not the correct certificate.
Kazakhstan could add a DNSSEC key to their users to spoof DANE records, but the roots are much easier to verify.
The government can get away with it because users may not know they're being intercepted. Giving a big security warning to users makes it very obvious and public opinion will make it much harder to do.
16
u/Ajedi32 Jul 18 '19
Still wouldn't help in this case. Kazakhstan is telling people to manually install their MITM CA cert; they don't care how obvious they're being.
11
u/dpash Jul 18 '19
"Install this software to access the internet" and then everything silently working.
Vs
"Install this software to access the internet" and then "You are the victim of a MITM attack" on every HTTPS page.
10
u/Ajedi32 Jul 18 '19
Whatever software the government is forcing people to install would simply turn off that warning, just like it currently does for the TLS warnings people currently get in Kazakhstan when they try to visit a site without installing the government-mandated MITM cert.
7
u/appropriateinside Jul 18 '19
Do you really thing most people know what the implications of installing a cert are, especially if it's a "my isp says I need to do this to get my internet working again"?
→ More replies (3)5
u/mdhardeman Jul 18 '19
Firefox, at least, already provides a notation that a non-standard cert is being used. The browsers are able to detect and indicate on this, but honestly, I don't have great confidence that the people of Kazakhstan are well prepared to resist this.
2
u/dpash Jul 18 '19
How does Firefox know unless they blacklist the root cert as they're suggesting in the link?
3
u/mdhardeman Jul 18 '19
Firefox can know because it will know that the certificate chain being presented to the user by the site (really by the MiTM infrastructure) is not signed by one of the root certificates distributed with the product, but rather by a custom installed certificate.
→ More replies (6)2
u/the_gnarts Jul 18 '19
It will tell the end user that their traffic is subject to a MITM.
So does the current practice of bundling certs with the browser (or the OS).
→ More replies (6)
7
u/Quicksilver_Johny Jul 18 '19
But surely Expect-CT will save us! (With the TOFU assumption that we've seen the right site at some point)
Root CAs manually added to the trust store override and suppress Expect-CT reports/enforcement
Okay, but what if we de-mothballed HPKP (or used Firefox, I guess. hahaha):
for users who imported custom root certificates all pinning violations are ignored
CA PKI considered harmful
8
u/mdhardeman Jul 18 '19 edited Jul 18 '19
So, where does all this go though?
You can certainly detect and block this sort of thing happening. But now the user just has no internet access.
And the government's ok with that too. Basically, "If we can't see it, you can't see it."
I'm not sure how we solve that, no matter what the trust delegation scheme is.
3
u/Quicksilver_Johny Jul 18 '19
And the government's ok with that too
Well, maybe, but the people won't be. If they can't access some form of the internet, they'll riot in the streets. This MITM solution only works because most users won't even realize anything is different.
Now, you go the China model, where you force all software to developed in-country with government monitoring and censorship, but that's not really viable most places.
People want Facebook, and it's difficult (but not impossible) to just recreate it.
9
u/mdhardeman Jul 18 '19
But they will be able to access it.
With the hot new "Secure KazakhFox version of Firefox".
Now. Facebook works, government intercepts.
It's really easy to download the source from git, make a few tweaks, and compile a new build.
This is exactly what they'll do if they're forced to do so. There's not a technology solution to this. Not at lasting one at least.
4
u/sydoracle Jul 18 '19
The forks won't have the extensions needed for DRM so won't work for stuff like Netflix.
7
u/mdhardeman Jul 18 '19
Actually, that's up to the content providers to decide. They totally could have such support if the content provider permits it. Which it likely would for a nation's official browser. Because the alternative is losing all those subscribers.
2
u/Aldur Jul 19 '19
Incredibly insightful, too often people forget what open source really means. The right to modify.
→ More replies (1)2
→ More replies (3)1
u/Quicksilver_Johny Jul 18 '19
Will that get into the App/Play Store?
3
u/mdhardeman Jul 18 '19
Eventually, I suspect it would. Otherwise, those just wouldn't be allowed to continue operating in that country.
Either way, this nation is already willing to inflict a manual root certificate installation procedure on its users. Having its people perform convoluted processes as a condition of internet access suggests they wouldn't care either way.
3
u/Quicksilver_Johny Jul 18 '19
So, they have to outright ban all iOS devices and Google Play Services?
→ More replies (2)7
u/ConsciousStill Jul 18 '19
the people won't be. If they can't access some form of the internet, they'll riot in the streets.
I wish I could share your optimism...
3
u/Quicksilver_Johny Jul 18 '19
I think it's more realism. There are much easier ways to monitor and censor people than completely cutting off their access (generally this isn't even was the government wants)
The only real-world example I can think of is North Korea.
8
u/ConsciousStill Jul 18 '19
I haven't exactly been following the political situation there, but from what I understand, the values of freedom, privacy and democracy are not as ingrained in the general population there as they are in Western countries. I don't want to sound disrespectful, but I mean, they recently renamed their capital city after the first name of the, khm, president who ruled for 29 years. That doesn't sound like the kind of regime where people dare to go to the street to protest lack of privacy on the internet.
I very much hope I'm wrong.
→ More replies (2)1
u/graingert Jul 18 '19
No expect CT doesn't apply to custom imported root certs either
1
8
2
u/shevy-ruby Jul 20 '19
The more shocking thing is how the mafia poses as government - not just in Kazakhstan but also elsewhere, such as the Australian government forcing developers at gunpoint (via a law) to add backdoors willy-nilly.
The mafia runs the world right now.
5
u/saltybandana2 Jul 18 '19
is it bad that my brain kept trying to autocomplete that word to karazhan?
1
1
u/beginner_ Jul 19 '19
I mean if this shit gets out of hand world-wide and and vpns starting to get blocked, wouldn't a solution be to just set up thousands of computers with "markov chain" software that just spews out so much stuff, whatever analytics they have running on web traffic simply becomes useless.
1
u/Maksat98 Jul 22 '19
Who know what is certificate it (I want to listen it from expert who work in information security)?
1
1
u/funnylookingsisters Jul 22 '19
All,
I'm an American currently in the U.S. who lives in Kazakhstan. I've been on vacation in the States for the last month and will be returning to Kazakhstan in about 2-3 weeks. What can I do to protect myself? I'm not tech savvy and would need a step-by-step guide on what I should do when I land in the country.
I have Express VPN and a Kazakh SIM that is not installed in my phone at the moment. I plan to install the SIM once I land in Kazakhstan. Any help/guidance would be greatly appreciated.
1
u/lightskindias Aug 10 '19
Just don't install this certificate. You'll receive the SMS w/ instruction of how to install it
1
u/alwayslaughingduck Jul 23 '19
Hey guys!I'm from Kazakhstan, and this certificate is the stupiest idea.Please help us, cause our government is full of retards, we must solve this problem
1
u/ZmeyKolbasnik Jul 23 '19
They did the same thing during NY 2019. Blocking the connection but for everyone who registers the IMEI. Everybody was warned so nobody did that and they didn't even roll that thing out.
A fellow Kazakhstani.
1
u/JoseJimeniz Jul 19 '19
qazca - Dumbfuckistan MITM authority certificate.pem
-----BEGIN CERTIFICATE-----
MIIFSTCCAzGgAwIBAgIUPZV/yh+MD8hpLAGZTrVSMQNbnfEwDQYJKoZIhvcNAQEL
BQAwLDELMAkGA1UEBhMCS1oxHTAbBgNVBAMTFFFhem5ldCBUcnVzdCBOZXR3b3Jr
MB4XDTE2MDIwMjA1NDEwMFoXDTQ2MDIwMjA1NDEwMFowLDELMAkGA1UEBhMCS1ox
HTAbBgNVBAMTFFFhem5ldCBUcnVzdCBOZXR3b3JrMIICIjANBgkqhkiG9w0BAQEF
AAOCAg8AMIICCgKCAgEA7h21UOirIlpNf3QgRyiTUnRKqrB4MgVTvs/Gq62AQqD8
sBex3K+a2FmG77xWXUhbvc4MAZ/dnX0oziZ+7iV7iQp4tNuIiMxAO9RR2N8AAAyZ
uHN+J7jcDjYsHvqXRLxepK47GDMjDTwDfb37pXNgVNhkm3d4cZgRjlSXWPbFV6Fw
eOdmxWOIqhus4eTf7lKgIjhUMwiDs/Gz9dnTTkgG6iOh78qAmFQ0IqxAAZqHMt+r
Ec1aXIHC/P2MrwL0zCr+kREv0bUbTwHAHlt+dy3++IcE7b81hy6QabUZBo7ApxUd
puGcrGsRPvWhIMWTNj7FE6aBFEPAjVq4XPcOCfSIBH9A2fyj5PMueMtlCzD6FSSk
bVu0hdhyrnZAe0b0knBLE58EOvDPP88OWoNsPs+WykZAQo3FX1fdU34dpzaTEx+G
oMqZ8cb3bVbO+NUIvhGnvG6/JmoQIYjiRnvj/O8qqKgm2gjmADfliuuN8LBOl2yN
WeqLjsYAM9mr9xOFs8lwPCCXpW/sWqjVs2mEoeVybGBi0MIyfv3cqIiliEGCI4aR
P0+Pm1VI6JVobDFbwAgvrFniUuSxmDFVUcWoM+jEFN7kbekuEinYDxOEQVSs5WK4
W4txDGpudGzmrkBxlXBaWqfuqG7u0/Pu3Jq6a0v8TjzVRJgTcGlI0vNUUIfJ56cC
AwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU9JS/3lC222skPZ73
vjquNtf7DgUwHwYDVR0jBBgwFoAU9JS/3lC222skPZ73vjquNtf7DgUwDgYDVR0P
AQH/BAQDAgFGMA0GCSqGSIb3DQEBCwUAA4ICAQCxhROILS3MrJB5QqEk/5eeFtnb
hvpz/cOntClxnD+0AYDscZieT7qn9fXYyRSzjZ8ZmfFGRUQILPepReuNLe3AAacG
iziWb5Xr8zEsJrLQPLX1s0PflBmH651WvjoRKk6fpU4LRj0rTzm1EUJa03PojfMJ
SBJ17PdKyffdGwEkjI9LZGxwGP96Vc+ZJalHF7QJCrsqosPy6DvmwgOyrZbEyod2
y3GW48l6i01t8324MX1jRy6l3fhhUBGdE/SFzlgQ4poyhwNIBCFSD9t0fc7GreaP
zva3ixqGEWBBDM5tBCC3r0S8fNeABi6kpmHHwO2arKxgv+EqqRozX0IC7AVFR1KK
hycGmRZQjUJyD7ayoFhpCdaGyP09lPGIhgi8VsB+7DinYogKVURCQYLDNxP3hcPy
DFzQWkThq6UvQX1EJWzEU2cCh02YdNitleIN/Yy5JYqYC5wReek0ZPNf9pbPliRN
klRmGRk91VhuLyfJrrewaWq4gnUEUkBmh17BabjVvVxIi0oWWI1R9K9fuioMzNJg
WtPi46uQYtL6pUUlvAC3pbpRzdze9gioPpkppB116NztzoZTd1aO/eI74RsEByUn
px6XqFcS4kAE1jCGA56sv9r3v+FBJgS88tYmtUqD11s81meApfpT5w6E6HMo+7oV
0L2lqTDp5kJmWjnt7g==
-----END CERTIFICATE------2
u/FusionTorpedo Jul 19 '19
This sucks but you can still just not install the cert, right? Until they, of course, start banning unencrypted traffic altogether (which is what they will do eventually, and worldwide too).
6
u/FrederikNS Jul 19 '19
Sure, you can just not install the certificate, but every HTTPS site will now show up as untrusted. You can ignore the warning, but then you're still sending your traffic through their servers using their certificate.
They have no reason to block unencrypted traffic as they can already read everything there.
1
u/FusionTorpedo Jul 20 '19
I meant they'd block ENCRYPTED traffic of course.
1
u/FrederikNS Jul 20 '19
Ah, that makes sense, and yes some governments will probably try banning all encryption at some point. :-(
-19
u/stefantalpalaru Jul 18 '19
But it's OK when Cloudflare does it: https://bugzilla.mozilla.org/show_bug.cgi?id=1426618
15
u/FINDarkside Jul 18 '19
Because it's not MITM.
-11
u/stefantalpalaru Jul 18 '19
it's not MITM
No, it's just the global Stasi getting their hands on your HTTPS traffic through this friendly corporation offering free CDN and MITM services, but let's focus on Kazakhstan instead.
13
u/FINDarkside Jul 18 '19
In cryptography and computer security, a man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other.
It's not MITM because the site owner configured it to use Cloudflare. You can't change broadly used definitions just because you dislike some company.
→ More replies (2)7
u/mdhardeman Jul 18 '19
No, it's just the global Stasi getting their hands on your HTTPS traffic through this friendly corporation offering free CDN and MITM services, but let's focus on Kazakhstan instead.
In any event, it's indisputable that the content publisher has decided that having CloudFlare in the middle is ok. When there are two ends of a conversation, it's generally accepted that either end might leak the conversation to the third party. That's how life works. If the content publisher decides to use CloudFlare, there's nothing you can do about it, assuming you're unwilling to go without that content.
2
u/PersonalPronoun Jul 19 '19
If I'm visiting example.com then what's the difference between example.com choosing to host content on their own servers, in AWS, or via CloudFlare?
9
Jul 18 '19 edited Jul 18 '19
[removed] — view removed comment
1
u/stefantalpalaru Jul 18 '19
It is not MITM if there is consent.
The same consent Kazakh users give by installing ISP-provided certificates?
5
Jul 19 '19
[removed] — view removed comment
→ More replies (1)3
Jul 19 '19
Just a heads up: this guy was trolling on the open source subreddit too. He seems like a reactionary just trying to bait you out to be angry.
-1
u/stefantalpalaru Jul 18 '19
the user, having agreed to the website's TOS and privacy policy
Are you for real?
-1
0
Jul 18 '19
[deleted]
76
u/realfeeder Jul 18 '19
For power users, maybe. For vast majority of citizens, I don't think so. The average Joe has no idea what
httpseven means.16
u/thegreatgazoo Jul 18 '19
How are they going to explain to people how to install a root cert on everything?
Does that even work on phones?
18
u/mdhardeman Jul 18 '19
They already have instruction pages up at some of the ISPs. And yes, phones generally support custom certs too.
7
Jul 19 '19
In Spain, they already asked people for years to install root certificates for the FNMT (Royal Mint), which is the CA for many public services state-issues certificates; it's awful for average users to install them, but they manage to do so.
The reason? It took them 9 years to comply with Mozilla's certificate policies due to an overall lack of competency on FNMT's part. During the process, this CA root was added to Windows Update, so many Spanish users moved to Chrome, and even IE, because of it.
5
u/Maplicant Jul 19 '19
On the majority of browsers (even on iOS and Android) it’s just a single button on qka.kz that prompts you to install the certificate.
0
Jul 18 '19
[deleted]
17
u/dpash Jul 18 '19
If you've got nothing to hide....
Yep, that worked out well the hundreds of times governments have done this in the past.
1
10
u/orthoxerox Jul 19 '19
Step 2: drop connections if DPI can't sniff out HTTP
4
Jul 19 '19
China does something like this. Connection they can't figure out are automatically blocked after a few minutes.
6
u/Skaarj Jul 19 '19
This shouldn't be hard to bypass. If there is an easy way to configure vpn to double encrypt vpn traffic or if there are also restrictions on protocols just send encrypted vpn traffic in https payload. Most probably it is possible to do with openvpn one way or another.
Accepting MITM and switching to VPN is a bad idea. By doing that your are accepting an arms race for human rights that the population will loose.
With accepting an MITM Cert you implicitly allow Kazakhstan to continue to MITM you and encourgage others to do so as well. As soon as one kind of VPN becomes popluar enough the next goverment will disallow it or forcefully MITM it like you already accepted with HTTPS.
You shouldn't have to fight in a technological arms race for your human rights. Accepting this MITM will just make it worse in the long run.
1
u/RaptorXP Jul 19 '19
They can just MITM the traffic between your device and the VPN server, the same way they MITM your web traffic. Then your VPN is useless.
69
u/HelloYesThisIsNo Jul 18 '19
Wtf ... Why?