• state censorship of non-Chinese content via the Great Firewall
• internal (to China) censorship of content by Chinese Internet companies
• self-censorship that is a hallmark of any regime that does not have free speech laws

These are but 3 of the many differences of the Internet in China vs. elsewhere.

Sadly, there are non-censorship related issues around commercial software vendors and their competitive practices that are terrible for Chinese Internet users.  The most recent battle on the Chinese Internet is between Tencent, who’s QQ brand has over 600 million users of their instant messaging service, and 360 an ‘anti-virus’ software company that has 300 million clients installed and is so aggressive as to cross the line (in my opinion) of marking legitimate software as “viruses” if they are competitive with any software that 360 also provides.

If I had to put this in Western terms, it would be as if Norton/Mcafee marked AOL Instant Messenger/Yahoo! IM/etc. as virus software.

360 vs QQ, Internet security company picks fight with China’s NO. 1 software giant (the Japanese manga-style cartoons are a little disturbing)

EastSouthWestNorth has translations of key statements from QQ and a news report from MOP:

360 PK Tencent (10/31/2010) (MOP)

360 Is Hackerware (11/01/2010) (QQ.com)

China Tech News is reporting that China’s Ministry of Industry and Information Technology and Ministry of Public Security is now involved in this corporate dispute without any resolution to date.

Qihoo 360: Chinese Government Interferes In Tencent Internet Dispute

And today, Tencent (QQ) has issued an ultimatum to it’s 600 million users that users of QQ cannot use 360′s anti-virus software.

Tencent threatens its users with an ultimatum

China’s Internet users have so many challenges to deal with, from the state, to the companies that run Chinese Internet services, that corporate in-fighting between Chinese application providers (who are not even directly competing with each other) should be the last straw.

My opinion? If you are an Internet user in China, switch to Linux or Mac OS and get off Windows, because Chinese application providers only build for Windows and thus getting off Windows means getting rid of the need for Chinese applications altogether.  You won’t have these problems with open source software.

For those of us who know how browsers and certificates and trust works, you may not learn anything new, but I think it’s important to see how browsers and certificates are viewed by people outside of the certificate authorities or browser industries. Indeed Andrew McLaughlin, previously at Google, is now White House deputy CTO under Aneesh Chopra and spoke at the event.

I came away with the impression that it is exceedingly difficult to explain how browsers secure transactions.  Mozilla comes off better than most because of how open our processes are.  Still, browser security looks like sausage to me- you don’t really want to learn how they’re made.

Center for Information Technology Policy – Emerging Threats to Online Trust: The Role of Public Policy and Browser Certificates

Additional relevant background in this post: Web Security Trust Models | Freedom to Tinker

I wanted to share two recent articles from Kim Tong-hyung, one covering the event that Mozilla’s Lucas Adamski attended at the end of April and another covering the “anti-virus” industry in Korea, which is one of the incumbent industries that would be significantly negatively affected if the Korean government moved away from the current PKI-based encryption architecture.

Experts Say Specific Tech Mandates Make [Korean] Internet Banking Vulnerable

“There is danger in relying on technology too much, and specific technology in that,” Schneier said, stressing that the government should be commanding “results,” rather than technologies, from banks and credit-card companies in their efforts to provide better user protection.

“Once a law mandates specific technologies such as protocol, applications or software, innovation stops. Companies know they will be okay as long as they do everything that the law says, and they will not figure out ways to make things more secure.

and

Lucas Adamski, who heads the software security team at Mozilla, which backs the Firefox Web browser, said online banking and e-commerce providers should consider redesigning their Web pages to support HTTPS, or HTTP Secure.

“Supporting HTTPS comes with many benefits. The server is authenticated to ensure the user is talking to the server they think are talking to, before any content is sent or received,” Adamski said.

“The browser will not normally send or receive any content from a Web site with an invalid or expired certificate or if the certificate does not match the server name. This means that there is no opportunity for a man-in-the-middle (MITM) injection attack to happen in the first place.”

Is AhnLab to blame for online banking mess?

Kim Kee-chang, a Korea University law professor who had led a series of unsuccessful lawsuits against the government over the overwhelming Active-X use, is absolutely merciless when describing the role of AhnLab and other anti-virus firms in the whole mess.

“Anti-virus firms are the only ones who are benefiting from the current Internet banking structure, which itself happens to be the biggest fraud of all. This system is all about creating an illusion of security that essentially does nothing other than allowing these software makers to make easy money off aging technology,” Kim said in a recent interview with The Korea Times.

“It’s depressing to see these so-called Internet technology experts sinking so low, sacrificing their morality to the last ounce in pursuit of profit. They have government officials in their pockets, as nobody ever accuses bureaucrats of having a bright understanding of technology,” he said, emphasizing that it was the anti-virus firms that chose plug-ins as the method to provide the required security programs to banks and computer users.

In fact, one of the new pressures on the status quo has been the popularity of the iPhone in South Korea, which wasn’t available officially until late 2009 due to a different Korean software middle-ware requirement, WIPI, which has since been deprecated. With WIPI dead and buried, Apple released the iPhone to great fanfare in the Korean market and Blackberry has also launched in the Korean market.

Another pressure on the status quo was a recent report out from 3 researchers (Hyoungshick Kim, Jun Ho Huh and Ross Anderson) from the University of Oxford’s Computing Laboratory, “On the Security of Internet Banking in South Korea.”

South Korean Internet banking systems have a unique way of enforcing security controls. Users are obliged to install proprietary security software – typically an ActiveX plugin that implements a bundle of protection mechanisms in the user’s browser. The banks and their software suppliers claim that this provides trustworthy user platforms. One side-effect is that almost everyone in Korea uses IE rather than other browsers.

We conducted a survey of bank customers who use both Korean and other banking services, and found that the Korean banks’ proprietary mechanisms impose significant usability penalties. Usability here is strongly correlated with compatability: Korean users have become stuck in an isolated backwater, and have not benefited from all the advances in mainstream browser and security technology. The proprietary mechanisms fail to provide a trustworthy platform; what’s more, alternative strategies based on trustworthy computing techniques are quite likely to suffer from the same usability problems. We conclude that transaction authentication may be the least bad of the available options.

The popularity of the iPhone (the press claims 500,000 units sold in the few months since it was released) resurfaced the issue that only Windows and IE can be used to make secure transactions with Korean Internet services. iPhone/Blackberry/Android users in Korea (not to mention Firefox/Opera/Safari/Chrome users) cannot bank online or purchase items online or do any secure transaction with the smartphone browser because Korean services only support the PKI mechanism that only works with Active-X in IE and Windows.

Dr. Keechang Kim of Korea University has been working tirelessly for many years to try to change the status quo in Korea around browsers and the reliance on a PKI mechanism that is tied to one platform. With concern being raised by different parts of the Korean government, including the Korean Communications Commission as well as the Office of the President of Korea, Keechang has gathered a very interesting panel of presentations for April 29th in Seoul.  The panelists will be addressing the (Korean) Financial Supervisory Service (FSS) which is the regulatory body in Korea that is currently mandating the PKI mechanism that is in place today (which requires Active-X, etc.)  Unless the FSS relaxes or changes their regulations, Korean banks cannot offer other mechanisms for Korean users to bank online, etc.  In short, unless the FSS changes their stance, nothing will change in Korea.

“Security Issues of Online Banking & Payment in Korea” is an open public meeting (registration recommended) starting at 10 AM on April 29th at COEX Conference Hall E1 and will feature:

• Bruce Schneier (Chief Security Technology Officer, BT) on “Security: What Works, What Doesn’t, and Why”
• Hyoungshick Kim, Jun Ho Huh (Univ. of Oxford) “What’s the danger of mandating proprietary security solutions?”
• Lucas Adamski (Dir. Security Engineering, Mozilla) on “Securing Browser Interactions”

Again this meeting is open to the public. Anyone is welcome to attend.

While I have no illusions that one meeting will get the key Korean government entities to do a 180 from their current stance, I do think this will be an important opportunity to bring external, Korean and non-Korean security expertise to Korea to discuss the current state of affairs and show that a PKI-based security architecture is only as secure as the computers that those certificates are used on.  If the computers are compromised, and at least one security services provider, Network Box, claims that S. Korea is the largest source for malware in the world, (Korea reigns as king of malware threats) then there is no way to be sure that the person in control of those personal certificates is the legitimate owner.

The deletion of the requirement for WIPI in Korean mobile phones opened the Korean market to the iPhone and the Blackberry and Android phones from outside of Korea.  Korean users of these new smartphones realized that they could not bank online, buy online, etc. and are now pressuring the Korean government to change the current laws which mandate a PKI-based mechanism that has been implemented with Active-X.  As the popularity of smartphones that cannot make use of the current PKI-based architecture for encryption/authentication grows in Korea, the pressure for the government to change their regulations will only mount.  The key question for Mozilla is whether the Korean government will open up to a point where Firefox and Fennec can be used in the future for secure transactions in Korea.

Thank you to Keechang and everyone in the OpenWeb.or.kr community for your tireless efforts to try to break open the Korean market. Thank you also to Channy Yun who has put aside his own schedule in order to participate and guide Lucas in Seoul.  There is still a long road to walk to an open, competitive market in S. Korea for browsers, but I am starting to see the light at the end of the tunnel.

Windstream Communications, a large ISP based on the East Coast of the US, has been caught using DNS redirection of the search results from the Google Toolbar in Firefox. Users using the Google Toolbar in Firefox were served a Windstream search results page, not a Google search results page. I’m not clear how this could even be done but this should never ever happen.

Windstream Hijacking Firefox Google Toolbar Results – Users kick back, Windstream promises correction tonight

Once their customers started complaining, Windstream representatives posted at dslreports.com that

“I won’t go into the technical details, but this was not a desired result to modify the Firefox search field regardless of which search provider is used in the browser.”

Somehow I can’t give this company the benefit of the doubt.

Edit:

Firefox redirects to windstream communications search results when I do a Google search in the search bar. (Mozilla Firefox support forums)

and

How do I remove a web search redirect? (Google Web Search Help Forum)

The video from his presentation is now online (in Windows Media) and covers some of the challenges facing the Korean Internet, including two mentions of the Microsoft browser monopoly in Korea.

TEDxSeoul Talks – [Changwon Kim] Korea Internet Galapagos

Korea’s Internet Is Mired in a Microsoft Monoculture

Korea is at the cutting edge in technology, the state of the art in e-commerce, an early adopter of third-generation wired and wireless communication, broadband and personal media. Yet 99.9 percent of computer users are on Microsoft Windows. Mac users cannot bank or shop online, nor do these users have access to government websites. The same goes for users of Linux, the free user-generated OS, and those using Mozilla Firefox or Opera to browse the web.

The observation comes from an early 2007 entry on a Japanese blog, written shortly after the blogger’s disappointing visit to Korea. It is not an unfair assessment nor is it borne of jealousy. Korea’s Internet monoculture has been a subject of concern here for some time and remains an issue. In a recently published book, Kim Ki-chang, a professor at Koryo University, says that Korea’s Internet environment is so unsound that nothing like it can be found in any other country in the world.

What is the problem? For one thing, accessing many Korean websites requires jumping through hoops not found anywhere else in the world. This may mean installing unfamiliar software programs, one to ensure secure access, another to protect against keystroke tracking, another for personal firewall protection, and on top of that, an antivirus program, all to be able to do some banking online. Nowhere else are websites so complicated and inconvenient.

It is also a uniquely Korean peculiarity that the programs needed for access to secure websites are compatible only with Microsoft Internet Explorer. Many are based on the ActiveX framework from Microsoft. And while there exist other technologies that perform the same function, none are in use in Korea. As a result, web browsers such as Firefox used by over 20 percent of users worldwide have no presence here.

Not much new here that has not been covered by me in the past but it is news to me that Kim Keechang has published a book on this topic.

A few choice quotes:

But the land of ubiquitous broadband, feature-happy “smart” phones and ultra-cool computing devices doubles as a crusty regime where Linux, Firefox, Chrome and Opera users can’t bank or purchase products online, and where Mac users buy Windows CDs to prevent their devices being reduced to fashion items.

The bizarre coexistence of advanced hardware and an outdated user environment is a result of the country’s overreliance on the technology of Microsoft, the U.S. software giant that owns the Korean computing experience like a fat kid does a cookie jar.
…
Critics say the country would end up paying dearly for allowing a Microsoft monoculture to take hold, with consumers deprived of the freedom to choose newer and better products and the Web industry seeing its innovation compromised.

(Anyone want to send me a Steve Ballmer with cookie jar photoshop masterpiece? )

The article goes on to cover a lot of the issues affecting web users in Korea and how many valiant efforts have gone into trying to affect change, most significantly the 3 lawsuits that Dr. Keechang Kim has brought against various Korean policy-making bodies, without success.

The newest effort of the open web community in Korea is openbank.or.kr, an effort to push/educate banking institutions in Korea to change their practices as many believe it is these consumer-facing services which are key to making real change happen for an open web in Korea.

Mozilla is committed to supporting the Koreans who are pushing for a competitive truly open web in Korea. If there is something that we should be doing in Korea to further support open web efforts, please do not hesitate to contact me or leave a comment with your thoughts.

I, for one, look forward to a day when anyone in Korea can use any modern browser on any major consumer computer operating system to bank, purchase goods/services online, trade stocks, etc. without the need for a browser plugin.

With the most recent update to Safari 3.2, Apple has added support in their user interface for extended validation SSL certificates, or EVSSL.

The problem with Safari 3.2′s implementation is that the UI is quite subtle, way in the upper-right hand corner. There’s no standard as to how to implement support for EV certs in browsers but clearly what Apple has done with Safari is mere compliance, not a thorough consideration of how best to show that information in the browser.

I’m biased but I clearly think Firefox 3.0′s implementation is better. No certificate mumbo-jumbo that no one outside of certificate authorities knows anything about.  Clear and obvious language that is readable and understandable by anyone who would use a browser on the Internet.