Feeds

Nokia decrypts browser traffic, assures public not to worry

It’s acceleration, not snooping, say Finns

The Essential Guide to IT Transformation

Just as Nokia announces numbers that look like it may avoid irrelevance, the mobile supplier has become embroiled in a privacy row centered on the behavior of its browsers.

The brouhaha hit the wires when Unisys Global Services India security architect Gaurang Pandya wrote up his investigations into the behavior of his Nokia Asha phone.

Discovering that browser traffic was being diverted to proxy servers owned by Nokia – a common behavior in the mobile world designed to improve browser performance on skinny mobile data links – Pandya began investigating what else was happening to his traffic.

The results are documented here. In brief, Pandya accuses the vendor of staging a man-in-the-middle attack against its own users: even for HTTPS traffic (his test case was https://www.google.com), he writes, the phone sends a DNS request to the Nokia-owned cloud13.browser.ovi.com domain.

This raised the question of how the ovi.com server was handling certificates. By packet-sniffing the traffic, Pandya identified Nokia certificates that the phone was pre-configured to trust – with the result that the substitution of the ovi.com server for Google didn’t throw out a security warning.

His conclusion is that this behavior gives Nokia full, unencrypted access to browser traffic.

According to TechWeek Europe, Nokia has agreed that the diversion takes place, to allow it to compress Xpress mobile browser traffic for acceleration. The company denies storing the data, and says that none of the traffic is visible to any of its staff.

“Importantly, the proxy servers do not store the content of web pages visited by our users or any information they enter into them. When temporary decryption of HTTPS connections is required on our proxy servers, to transform and deliver users’ content, it is done in a secure manner,” the vendor told TechWeek Europe.

The row comes as Nokia announced what looks like a turnaround, releasing financials showing a profit on smartphone sales, compared to an October forecast for a 10 percent loss. It announced fourth-quarter sales of 4.4 Lumia units and 9.3 of the low-end Asha smartphones. ®

Build a business case: developing custom apps

More from The Register

next story
Trying to sell your house? It'd better have KILLER mobile coverage
More NB than transport links to next-gen buyers - study
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
Scotland's BIG question: Will independence cost me my broadband?
They can take our lives, but they'll never take our SPECTRUM
NBN Co adds apartments to FTTP rollout
Commercial trial locations to go live in September
Samsung Z Tizen OS mobe is post-phoned – this time for good?
Russian launch for Sammy's non-droid knocked back
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.