News for hackers. Stuff that matters.
Re:Mozilla takes action to protect users in Kazakhstan by dantondwa on Wednesday August 21, 2019 @12:02PM (#20758538)
What's your point? Mozilla and Google here are preventing the government bogus CA from being used to bypass encryption. You can talk to whoever you want, and in full safety (as opposed to doing so while being spied by a tyrannical government like Kazakhstan).
Re:Mozilla takes action to protect users in Kazakhstan by rocqua on Wednesday August 21, 2019 @12:13PM (#20758669)
Advocating for the devil here.

Installing a cert in the local root store means 'I fully trust the owner of this certificate'. It is an intentional feature of TLS to use this to be able to consensually MitM a TLS connection.

Yet here, western companies have decided that, regardless of whether the user wants to be Man in the Middle -ed by Kazakhstan, they simply cannot. This is inherently a political and not a technical decision. What Kazakhstan is doing is not actually breaking TLS, but instead using a feature.

Re:Mozilla takes action to protect users in Kazakhstan by Ajedi32 on Wednesday August 21, 2019 @12:47PM (#20758974)
I guess the real problem is that it's not immediately obvious to non-technical users what the implications are of installing a government-issued MITM CA certificate.

That could potentially be fixed with better UI, but even then it's rather hard to communicate the danger when the user is under the influence of a social engineering attack from their own ISP. (E.g. "This certificate is needed to ensure your security. Just ignore that warning from your browser, it's not important.)

Re:Mozilla takes action to protect users in Kazakhstan by rocqua on Wednesday August 21, 2019 @03:49PM (#20760955)
This is not a social engineering attack, or at least it need not be. It is simply made a requirement; block any connections to the outside that do not use the certificate. Then people have a choice of no HTTPS (which blocks many big sites) or HTTPS that is MitMed by the government.

Incidentally, the above is why the 'consensual MitM-ing through a root-Cert is a feature of TLS' does not hold op. It is not consensual, it is not even coerced, it is a hard requirement. You could then go into an argument about national sovereignty / complying with local laws, but that is a totally different argument.

Re:Mozilla takes action to protect users in Kazakhstan by vbezhenar on Wednesday August 21, 2019 @03:23PM (#20760653)
I'm all for improving communication with user. But blacklisting certificate does nothing but harm.
Re:Mozilla takes action to protect users in Kazakhstan by lone_haxx0r on Wednesday August 21, 2019 @02:25PM (#20759979)
If I want to talk to the tyrannical government using their CA, I can't do it using Chrome or Firefox.

Look, I'm as pro-freedom as they come and I'm against coercing people to install certificates, but I also think good tools don't leverage their popularity to push their political opinions, even if I agree with those opinions. Good tools allow their user to do whatever is technically possible, even if the tool maker doesn't like that use-case.

The political and personal relationships of the user fall outside the realm of concern of the tool.