<font face="times new roman" size="2"><p style="margin:0;padding:0;">Where is the data decompressed again? That's a vulnerable point, too. It's where I would attack - a much more "target rich environment" to make money, because you see *everybody's* data in the clear there.</p>
<p style="margin:0;padding:0;"> </p>
<p style="margin:0;padding:0;">In other words, the vulnerability is not just "in the phone" but systemic.</p>
<p style="margin:0;padding:0;"> </p>
<p style="margin:0;padding:0;">Creating a concentrated vultnerability, with uncertain protection - in the US, this would also violate HIPAA compliance, which is a *very* serious law, with very severe monetary and felony criminal consequences for anyone who systematically opens up encrypted personal health-related data. One violation by Nokia technology would be enough to trigger the HIPAA stuff, if intentional.</p>
<p style="margin:0;padding:0;"> </p>
<p style="margin:0;padding:0;"> </p>
<p style="margin:0;padding:0;">-----Original Message-----<br />From: "Maciej Soltysiak" <maciej@soltysiak.com><br />Sent: Thursday, January 10, 2013 11:50am<br />To: dpreed@reed.com<br />Cc: cerowrt-devel@lists.bufferbloat.net<br />Subject: Re: [Cerowrt-devel] Nokia decrypts user's HTTPS to compress to improve speed<br /><br /></p>
<div id="SafeStyles1357854326">
<div class="gmail_quote">On Thu, Jan 10, 2013 at 3:58 PM, <span dir="ltr"><<a href="mailto:dpreed@reed.com" target="_blank">dpreed@reed.com</a>></span> wrote:<br />
<blockquote class="gmail_quote" style="border-left: #ccc 1px solid; margin: 0px 0px 0px 0.8ex; padding-left: 1ex;"><span style="font-family: times new roman;">
<p style="margin:0;padding:0;margin: 0px; padding: 0px;">I'm curious if they have data about how much compression they are achieving? Most HTTPS servers are set up by people who use quite a bit of compression in the payload (gzip of web pages, etc, "minification" of javascript), so I would hypothesize that the actual savings are minimal on the average.</p>
</span></blockquote>
<div>My finger in the air suggests that it is no more than 30% on average. Is it worth it? If it's up to 1/3 of more media time available for other stations to send data, perhaps it is.</div>
<div></div>
<blockquote class="gmail_quote" style="border-left: #ccc 1px solid; margin: 0px 0px 0px 0.8ex; padding-left: 1ex;"><span style="font-family: times new roman;">
<p style="margin:0;padding:0;margin: 0px; padding: 0px;">However, it points out that there is a man-in-the-middle problem with HTTPS alone. Your phone's browser should be checking the certificates more rigorously than it does. It can do that quite easily, and I think the destination can do that in Javascript that comes with the pages.</p>
</span></blockquote>
<div>Hmm, wouldn't something like HTTPS Everywhere + SSL Observatory help here? It should detect the certs are different than what they've been seen by other users.</div>
<div></div>
<blockquote class="gmail_quote" style="border-left: #ccc 1px solid; margin: 0px 0px 0px 0.8ex; padding-left: 1ex;"><span style="font-family: times new roman;"><span style="font-family: times new roman;">
<p style="margin:0;padding:0;margin: 0px; padding: 0px;">"We don't look" is not a defense in the EU privacy regime, and probably not in the US one (though many US Senators think that ISP's looking at content is just fine).</p>
</span></span></blockquote>
<div>You are right. There's a different angle than privacy here too. A one that users should be able to understand better. Such a phone might also be a security threat. Maybe Nokia don't do anyting with except compression, but malicious code knowing this might steer the compromised browser+dodgy_cert+phone to rob you of money in your bank.</div>
<div></div>
<div></div>
<div></div>
<div>Maciej</div>
<div></div>
<blockquote class="gmail_quote" style="border-left: #ccc 1px solid; margin: 0px 0px 0px 0.8ex; padding-left: 1ex;"><span style="font-family: times new roman;">
<div>
<div class="h5">
<p style="margin:0;padding:0;margin: 0px; padding: 0px;">---Original Message-----<br />From: "Maciej Soltysiak" <<a href="mailto:maciej@soltysiak.com" target="_blank">maciej@soltysiak.com</a>><br /> Sent: Thursday, January 10, 2013 9:46am<br />To: <a href="mailto:cerowrt-devel@lists.bufferbloat.net" target="_blank">cerowrt-devel@lists.bufferbloat.net</a><br />Subject: [Cerowrt-devel] Nokia decrypts user's HTTPS to compress to improve speed<br /><br /></p>
<div>
<div><a href="http://yro.slashdot.org/story/13/01/10/1356228/nokia-admits-decrypting-user-data-claiming-it-isnt-looking" target="_blank">http://yro.slashdot.org/story/13/01/10/1356228/nokia-admits-decrypting-user-data-claiming-it-isnt-looking</a></div>
<div>Have a look at what corporations resort to when they're in need of serious debloating and things like TCP Fast Open? :-|</div>
<div>Regards,</div>
<div>Maciej</div>
</div>
</div>
</div>
</span></blockquote>
</div>
</div></font>