News for hackers. Stuff that matters.

A comment on One of the Most Alarming Internet Proposals I've Seen. Parent comment

Re:One of the Most Alarming Internet Proposals I've Seen by MaulingMonkey on Sunday February 23, 2014 @05:41PM (#7288001)
To play devil's advocate, this could potentially be less harmful than the existing situation: where e.g. various corporate nets will require you to install root certs to accomplish the same MITM attack, in a less visible fashion (after installation), with some if not all of the same caveats - especially if given the ability to opt out.

(Bugs, insufficiently scary UI, and "discovery" are all massive concerns of course...)

[ Parent | on HN ]
Re:One of the Most Alarming Internet Proposals I've Seen by quotemstr on Sunday February 23, 2014 @06:32PM (#7288221)
> various corporate nets will require you to install root certs to accomplish the same MITM attack

They don't even bother making you install CA certificates. They just abuse subordinate CAs: see https://blog.mozilla.org/security/2013/02/15/announcing-vers...

I'm also a huge fan of Google's http://www.certificate-transparency.org/, which makes it very difficult to fool very many people for very long.

[ Parent | on HN ]
Re:One of the Most Alarming Internet Proposals I've Seen by atmosx on Sunday February 23, 2014 @06:23PM (#7288172)
Hm, no. Various corporate networks doesn't classify as an ISP, the number of potentially abused users is not the same. A company can do whatever it wants to, an ISP offers a service and should respect the privacy of it's costumers, at least theoretically.
[ Parent | on HN ]
Re:One of the Most Alarming Internet Proposals I've Seen by wmf on Sunday February 23, 2014 @06:34PM (#7288234)
This proposal isn't intended for ISPs and should never be used on the public Internet.
[ Parent | on HN ]
Re:One of the Most Alarming Internet Proposals I've Seen by atmosx on Sunday February 23, 2014 @06:44PM (#7288270)
Oh, my bad then. I miss-understood the proposal and it's implications. But since the protocol supports that, how can we be sure that ISPs won't use it?
[ Parent | on HN ]
Re:One of the Most Alarming Internet Proposals I've Seen by MaulingMonkey on Sunday February 23, 2014 @07:04PM (#7288334)
Cynically, "we can't". Or "they already have better options".

Alternatively, outcry and blacklisting ISP proxies - just as we do with root cert abuse.

[ Parent | on HN ]