Comments on: How Do Transcoders Affect HTTPS? http://www.masabi.com/2009/01/23/how-do-transcoders-affect-https/ The ticket machine in your pocket Sat, 23 Jan 2010 20:27:25 +0000 http://wordpress.org/?v=2.8.6 hourly 1 By: Martin http://www.masabi.com/2009/01/23/how-do-transcoders-affect-https/comment-page-1/#comment-60 Martin Fri, 30 Jan 2009 07:29:00 +0000 http://masabi.com/2009/01/how-do-transcoders-affect-https.html#comment-60 Hi Tom,<br/><br/>the APN config had no Web proxy configuration so I guess it is the "Internet" configuration.<br/><br/>Kind regards,<br/>Martin Hi Tom,

the APN config had no Web proxy configuration so I guess it is the “Internet” configuration.

Kind regards,
Martin

]]> By: Tom Godber http://www.masabi.com/2009/01/23/how-do-transcoders-affect-https/comment-page-1/#comment-59 Tom Godber Wed, 28 Jan 2009 11:54:00 +0000 http://masabi.com/2009/01/how-do-transcoders-affect-https.html#comment-59 Hi Martin,<br/><br/>I can actually quite believe that the bank is being whitelisted by the transcoder, however I doubt Bugzilla is. Do you know which network settings your browser was using - Wap or Internet? I believe that only one of these (Wap?) uses the Novarra transcoder, the other does not.<br/><br/>As I said I'm going to plan some more research of this and will post up the results, but all interesting to know!<br/><br/>Tom Hi Martin,

I can actually quite believe that the bank is being whitelisted by the transcoder, however I doubt Bugzilla is. Do you know which network settings your browser was using – Wap or Internet? I believe that only one of these (Wap?) uses the Novarra transcoder, the other does not.

As I said I’m going to plan some more research of this and will post up the results, but all interesting to know!

Tom

]]> By: Martin http://www.masabi.com/2009/01/23/how-do-transcoders-affect-https/comment-page-1/#comment-58 Martin Tue, 27 Jan 2009 22:41:00 +0000 http://masabi.com/2009/01/how-do-transcoders-affect-https.html#comment-58 Hi Tom, thanks for the feedback! <br/><br/>I have checked with a Vodafone UK prepaid SIM (APN: pp.vodafone.co.uk), a Nokia N95 and the S60 browser and the mobile banking portal of the German postbank (https://mobile.postbank.de). The https connection was established end to end and the certificate shown in "tools - page info" showed the correct owner (mobile.postbank.de, Deutsche Postbank AG) and the correct Issuer (VeriSign Trust Network). <br/><br/>I cross-checked with Firefox on the PC and the certificate information including the fingerprint were the same. So if the prepaid connection uses a transcoder, it doesn't brake into this connection. Also, it seems unlikely, Voda UK "whitelists" the German postbank. Not impossible, but unlikely :-)<br/><br/>I also tried with https://bugzilla.mozilla.org and the https certificate in the S60 browser was also o.k. so the connection was end to end.<br/><br/>Do you know specific operators who break into HTTPS connections?<br/><br/>Cheers,<br/>Martin Hi Tom, thanks for the feedback!

I have checked with a Vodafone UK prepaid SIM (APN: pp.vodafone.co.uk), a Nokia N95 and the S60 browser and the mobile banking portal of the German postbank (https://mobile.postbank.de). The https connection was established end to end and the certificate shown in “tools – page info” showed the correct owner (mobile.postbank.de, Deutsche Postbank AG) and the correct Issuer (VeriSign Trust Network).

I cross-checked with Firefox on the PC and the certificate information including the fingerprint were the same. So if the prepaid connection uses a transcoder, it doesn’t brake into this connection. Also, it seems unlikely, Voda UK “whitelists” the German postbank. Not impossible, but unlikely :-)

I also tried with https://bugzilla.mozilla.org and the https certificate in the S60 browser was also o.k. so the connection was end to end.

Do you know specific operators who break into HTTPS connections?

Cheers,
Martin

]]> By: Tom Godber http://www.masabi.com/2009/01/23/how-do-transcoders-affect-https/comment-page-1/#comment-57 Tom Godber Tue, 27 Jan 2009 12:35:00 +0000 http://masabi.com/2009/01/how-do-transcoders-affect-https.html#comment-57 Hi Martin,<br/><br/>I think the sad truth here is that you are absolutely right, a mobile browser *should* make the user aware of a man in the middle attack and a transcoder. However we know a number do not actively do this (the user has to know to check the certificate).<br/><br/>I am going to do a follow-up post after looking into this in more detail, hopefully showing what browsers do show with and without transcoders on mainstream handsets.<br/><br/>Tom Hi Martin,

I think the sad truth here is that you are absolutely right, a mobile browser *should* make the user aware of a man in the middle attack and a transcoder. However we know a number do not actively do this (the user has to know to check the certificate).

I am going to do a follow-up post after looking into this in more detail, hopefully showing what browsers do show with and without transcoders on mainstream handsets.

Tom

]]> By: Martin http://www.masabi.com/2009/01/23/how-do-transcoders-affect-https/comment-page-1/#comment-55 Martin Mon, 26 Jan 2009 16:21:00 +0000 http://masabi.com/2009/01/how-do-transcoders-affect-https.html#comment-55 Hi,<br/><br/>Very interesting post, thanks for that! I have one question which you might be able to answer:<br/><br/>In case a transcoder would try to put itself in the middle of a HTTPS connection, doesn't the mobile web browser issue a certificate warning? If not then how can it differentiate between a transcoder and a man in the middle attack?<br/><br/>Thanks,<br/>Martin Hi,

Very interesting post, thanks for that! I have one question which you might be able to answer:

In case a transcoder would try to put itself in the middle of a HTTPS connection, doesn’t the mobile web browser issue a certificate warning? If not then how can it differentiate between a transcoder and a man in the middle attack?

Thanks,
Martin

]]> By: srowen http://www.masabi.com/2009/01/23/how-do-transcoders-affect-https/comment-page-1/#comment-54 srowen Sat, 24 Jan 2009 12:07:00 +0000 http://masabi.com/2009/01/how-do-transcoders-affect-https.html#comment-54 Well explained, great post. Well explained, great post.

]]> By: Anna Gudmundson http://www.masabi.com/2009/01/23/how-do-transcoders-affect-https/comment-page-1/#comment-53 Anna Gudmundson Fri, 23 Jan 2009 13:18:00 +0000 http://masabi.com/2009/01/how-do-transcoders-affect-https.html#comment-53 Thanks for good post. It's important to spread awareness of these fundamental matters. <br/>I'll pass it on. Cheers. Thanks for good post. It’s important to spread awareness of these fundamental matters.
I’ll pass it on. Cheers.

]]>