Re:MITM on HTTPS traffic in Kazakhstan
by akersten on Thursday July 18, 2019 @03:15PM
(#20473037)
Google, Mozilla, and Microsoft need to take a stand here and blacklist these certs. All of the efforts to move to HTTPS, and all of the rhetoric surrounding it, are just wasted time and empty words if we as a tech community allow this kind of behavior to go unchallenged. This sets such a dangerous precedent, and governments need to know that this kind of meddling will not be tolerated.
[ Parent
| on HN ]
Hello,
To continue using internet, you need to install our government-provided fork of Firefox that doesn't blacklist our government-provided root cert.
regards, your Tele2
Re:MITM on HTTPS traffic in Kazakhstan
by mdhardeman on Thursday July 18, 2019 @04:29PM
(#20473651)
That's exactly what will happen if they all-out blacklist. The best near-term option may be a compromise: a special indicator in the browser UI that the connection has been set up in such a way that some organization may be monitoring.
Yes, this kind of indicator should always have existed for the corporate and anti-virus local roots as well.
for all we know NSA may already be doing that all the time, and they're only the worst of the good guys.
Re:MITM on HTTPS traffic in Kazakhstan
by mdhardeman on Thursday July 18, 2019 @05:07PM
(#20473930)
Modern browsers require that leaf certificates which are issued in a chain which descends from a built in publicly trusted root include "certificate transparency" information. This means that the certificate has been published in numerous public logs and so would be discovered.
No doubt the NSA intercepts all kinds of things, but they're not doing it with TLS MITM technology (at least not without further additional hacks).
That is, assuming that your downloaded copy of Firefox contains these root certificates and not some different ones.
Re:MITM on HTTPS traffic in Kazakhstan
by shushpanchik on Friday July 19, 2019 @05:34AM
(#20477244)
They don't even need to fork Firefox - there are couple of Russian browsers (https://browser.yandex.com/, https://browser.ru/) that would definitely allow Kazakhstan government to snoop into traffic (and hey even have Kazakh language support already). ISP will just advise clients that bad western companies banned Kazakhstan, so please use good safe Russian browsers.
Let's get Congress to do it - fix the collective action problem. Pass a law that says that all American companies are forbidden from serving traffic to countries which require their citizens to install compromised roots on their personal devices. Treat them like North Korea / Iran.