Re:Mozilla takes action to protect users in Kazakhstan
by Ajedi32 on Wednesday August 21, 2019 @12:47PM
(#20758974)
I guess the real problem is that it's not immediately obvious to non-technical users what the implications are of installing a government-issued MITM CA certificate.
That could potentially be fixed with better UI, but even then it's rather hard to communicate the danger when the user is under the influence of a social engineering attack from their own ISP. (E.g. "This certificate is needed to ensure your security. Just ignore that warning from your browser, it's not important.)
Re:Mozilla takes action to protect users in Kazakhstan
by rocqua on Wednesday August 21, 2019 @03:49PM
(#20760955)
This is not a social engineering attack, or at least it need not be. It is simply made a requirement; block any connections to the outside that do not use the certificate. Then people have a choice of no HTTPS (which blocks many big sites) or HTTPS that is MitMed by the government.
Incidentally, the above is why the 'consensual MitM-ing through a root-Cert is a feature of TLS' does not hold op. It is not consensual, it is not even coerced, it is a hard requirement. You could then go into an argument about national sovereignty / complying with local laws, but that is a totally different argument.
Installing a cert in the local root store means 'I fully trust the owner of this certificate'. It is an intentional feature of TLS to use this to be able to consensually MitM a TLS connection.
Yet here, western companies have decided that, regardless of whether the user wants to be Man in the Middle -ed by Kazakhstan, they simply cannot. This is inherently a political and not a technical decision. What Kazakhstan is doing is not actually breaking TLS, but instead using a feature.