Mozilla takes action to protect users in Kazakhstan

Re:Mozilla takes action to protect users in Kazakhstan by Ajedi32 on Wednesday August 21, 2019 @12:47PM (#20758974)

I guess the real problem is that it's not immediately obvious to non-technical users what the implications are of installing a government-issued MITM CA certificate.

That could potentially be fixed with better UI, but even then it's rather hard to communicate the danger when the user is under the influence of a social engineering attack from their own ISP. (E.g. "This certificate is needed to ensure your security. Just ignore that warning from your browser, it's not important.)

[ Parent | on HN ]

Re:Mozilla takes action to protect users in Kazakhstan by rocqua on Wednesday August 21, 2019 @03:49PM (#20760955)

This is not a social engineering attack, or at least it need not be. It is simply made a requirement; block any connections to the outside that do not use the certificate. Then people have a choice of no HTTPS (which blocks many big sites) or HTTPS that is MitMed by the government.

Incidentally, the above is why the 'consensual MitM-ing through a root-Cert is a feature of TLS' does not hold op. It is not consensual, it is not even coerced, it is a hard requirement. You could then go into an argument about national sovereignty / complying with local laws, but that is a totally different argument.

[ Parent | on HN ]

Re:Mozilla takes action to protect users in Kazakhstan by vbezhenar on Wednesday August 21, 2019 @03:23PM (#20760653)

I'm all for improving communication with user. But blacklisting certificate does nothing but harm.

[ Parent | on HN ]