Re:New German law would force ISPs to allow secret service t...
by vbezhenar on Thursday July 09, 2020 @06:46PM
(#23786146)
Browsers blacklisted Kazakhstan government certificate used for MITM which was not even trusted. It is absurd to expect anything less than blacklisting such a CA immediately. Certificate transparency is required for all certificates since April, 2018, so you can't really issue rogue certificate.
[ Parent
| on HN ]
Re:New German law would force ISPs to allow secret service t...
by razakel on Thursday July 09, 2020 @09:48PM
(#23787332)
Here's the Bugzilla report where they actually request their root be added to Firefox:
https://bugzilla.mozilla.org/show_bug.cgi?id=1232689
The answer is basically "no".
Re:New German law would force ISPs to allow secret service t...
by vbezhenar on Friday July 10, 2020 @06:01AM
(#23789819)
AFAIK they used different certificate for MITM. Currently they are using certificate mentioned in that bug to issue certificates for government websites (like https://elicense.kz/ ), so actually a lot of citizens who need to use government services have to install that certificate as a root anyway.
I don't think that they would use that certificate for MITM. They're not fools and they understand that it would lead to blacklisting it which would halt a lot of operations in the country.
Re:New German law would force ISPs to allow secret service t...
by int_19h on Tuesday July 14, 2020 @03:32AM
(#23829442)
> It is absurd to expect anything less than blacklisting such a CA immediately.
Is it, though? Germany has a lot more economic leverage than Kazakhstan. Suppose they pass a law requiring any browser sold or otherwise offered on the German market to have the government certificate in the chain of trust... how many large companies would cave?