RPRX

Member of Project X Community Ásgarðr VLESS & XTLS & REALITY & XHTTP

Results 745 comments of


                                            RPRX

TLS / QUIC 不应被继续视为可靠的加密方式，以及针对 TLS in Shadowsocks/TLS 的复合式 MITM，最后对于 VLESS Encryption 的介绍 / TLS/QUIC should no longer be considered a reliable encryption method, and compound MITM attacks targeting TLS in Shadowsocks/TLS. Finally, an introduction to VLESS Encryption.

**@oole345 不知道你从何而来的优越感，多次抬杠加嘲讽，毫无素质且令人作呕，你为反审查贡献过任何东西吗？为什么不敢用大号说话？对我批评伊朗面板明文 HTTP 一事怀恨在心？Blocked，就像我早该做的那样，给他点赞的人也是绝了，这种人也配？** @AkinoKaede TLS in TLS 还是所谓的“骗流量”吗？那这个不更是“骗流量”了？ **对于“植入根证书”并利用它这件事，有不少工具就是基于这个原理比如 https://github.com/net4people/bbs/issues/454 、“深信服”等，你们所谓的 enforced CTV 此时在哪呢？** 甚至 iOS 上一堆代理软件利用 MITM 来“去广告”，似乎最新的 26 版本才禁止，由于应用广泛，后续是否会重新开放也不知道 --- ***@oole345 I have no idea where you...

TLS / QUIC 不应被继续视为可靠的加密方式，以及针对 TLS in Shadowsocks/TLS 的复合式 MITM，最后对于 VLESS Encryption 的介绍 / TLS/QUIC should no longer be considered a reliable encryption method, and compound MITM attacks targeting TLS in Shadowsocks/TLS. Finally, an introduction to VLESS Encryption.

> [@RPRX](https://github.com/RPRX) 一点小的思考：如果攻击者有能力植入根证书，那整个设备都应被视为是不可信的。在这种情况下，攻击者当然也能修改设备上的客户端，从而 MITM 所有连接，我不认为针对 TLS 和其它协议的 MITM 有本质上的区别。 > > _A minor consideration: If an attacker can implant a root certificate, the entire device should be considered untrustworthy. In...

TLS / QUIC 不应被继续视为可靠的加密方式，以及针对 TLS in Shadowsocks/TLS 的复合式 MITM，最后对于 VLESS Encryption 的介绍 / TLS/QUIC should no longer be considered a reliable encryption method, and compound MITM attacks targeting TLS in Shadowsocks/TLS. Finally, an introduction to VLESS Encryption.

> It's a good reminder, Chinese people with a Huawei phone or other Chinese devices/browsers should be worried about it, but some of them are trolling and laughing, I don't...

TLS / QUIC 不应被继续视为可靠的加密方式，以及针对 TLS in Shadowsocks/TLS 的复合式 MITM，最后对于 VLESS Encryption 的介绍 / TLS/QUIC should no longer be considered a reliable encryption method, and compound MITM attacks targeting TLS in Shadowsocks/TLS. Finally, an introduction to VLESS Encryption.

@AkinoKaede > MDM can be used to embed certificates and disable Certificate Transparency, but the prerequisite is that the device is enrolled in MDM as an enterprise-managed device. > >...

TLS / QUIC 不应被继续视为可靠的加密方式，以及针对 TLS in Shadowsocks/TLS 的复合式 MITM，最后对于 VLESS Encryption 的介绍 / TLS/QUIC should no longer be considered a reliable encryption method, and compound MITM attacks targeting TLS in Shadowsocks/TLS. Finally, an introduction to VLESS Encryption.

@AkinoKaede > The problem of the operating system acting as spyware is unsolvable. > > Regardless of the encryption method, both the encrypted and decrypted data must appear in memory....

TLS / QUIC 不应被继续视为可靠的加密方式，以及针对 TLS in Shadowsocks/TLS 的复合式 MITM，最后对于 VLESS Encryption 的介绍 / TLS/QUIC should no longer be considered a reliable encryption method, and compound MITM attacks targeting TLS in Shadowsocks/TLS. Finally, an introduction to VLESS Encryption.

@ucker125 > [@RPRX](https://github.com/RPRX) FYI, that depends on the CT log verification strategy: https://httptoolkit.com/blog/chrome-android-certificate-transparency. If you need stronger security in anti-censorship software, you’ll need a stricter CT log verification policy —...

TLS / QUIC 不应被继续视为可靠的加密方式，以及针对 TLS in Shadowsocks/TLS 的复合式 MITM，最后对于 VLESS Encryption 的介绍 / TLS/QUIC should no longer be considered a reliable encryption method, and compound MITM attacks targeting TLS in Shadowsocks/TLS. Finally, an introduction to VLESS Encryption.

@Weltolk 请不要刷屏，我自己就用 OllyDbg 修改过很多软件，对系统 API hook 的事我也干过，破解软件、做外挂、免杀这些谁不会？假设我不了解这方面的知识是可笑的关于“恶意系统”的讨论在上面已有很多，区别就是攻击复杂度/是否需要“上报”的问题，我从未认为能够打败“恶意系统”，目标只是提高攻击成本，厂商能开的后门是有限度的，**一个恶意木马能做的事情也是有限度的，比如说如果你 hook 了一些敏感的 API，杀软会对此报毒，但如果你只是以“正当名义”安装了一个根证书，比如说游戏加速器/银行相关软件等，该行为会被合理化且你无法拒绝** *Please refrain from spamming. I've personally modified numerous software programs using OllyDbg and have experience hooking system APIs. Cracking...

TLS / QUIC 不应被继续视为可靠的加密方式，以及针对 TLS in Shadowsocks/TLS 的复合式 MITM，最后对于 VLESS Encryption 的介绍 / TLS/QUIC should no longer be considered a reliable encryption method, and compound MITM attacks targeting TLS in Shadowsocks/TLS. Finally, an introduction to VLESS Encryption.

@AkinoKaede 对 TLS 证书机制的批评当然不是第一次，但没有一次是像现在这样有切实的证据表明 GFW 实施过此类攻击，TLS 是为了通用的互联网应用而设计出来的，采用公共 CA 机制是难以避免的，**然而在反审查领域我们又不是没有别的选择，明明可以通过强制性标准的形式实现等价的 pin 证书为什么还要依赖在该安全实践上操作复杂且难以统一的 TLS？这就是我要表达的意思** *Criticism of the TLS certificate mechanism is certainly not unprecedented, but never before has there been concrete evidence...

Leak of Geedge Networks internal documents (100,000+ from Jira, Confluence, GitLab)

> While the censorship infrastructure having the ability to conduct MITM with malicious CAs isn't entirely surprising, a lack of certificate chain hash pinning within graphical clients of encrypted proxies...

Leak of Geedge Networks internal documents (100,000+ from Jira, Confluence, GitLab)

> 如果要用 CDN，则证书经常换，不同入口节点的证书可能都不同，pin 证书这个方式不太现实可能 pin root 证书好一点，我不确定 Xray 现有的 PinnedPeerCertificateChainSha256 PinnedPeerCertificatePublicKeySha256 是否支持不过套 CDN 总归是建议用 VLESS Encryption 的，那就无所谓，~~我觉得是时候把单纯的 TLS / QUIC 也列为“不够安全”了~~ --- > *If using a CDN, certificates...