3 ms·

Well, you could make everyone install a compromised SSL certificate... https://www.ietf.org/mail-archive/web/perpass/current/msg01979.html https://www.ietf.org

• Spivak 11y ago
  So you force your citizens to install a compromised SSL cert and can now impersonate any website. Now what? If you want to monitor someone don't you have to proxy all their traffic? Is that even feasible on a country wide scale? Because you can't do it intermittently since a user can just check which cert the key is signed with to tell you whether you're currently being monitored.
  • y4mi 11y ago
    > don't you have to proxy all their traffic? and that is one part of what the gfw does. google 'how does the gfw work' if you want a broad overview. there was a really in-depth explanation on HN not that long ago. sadly, i'm unable to find it at the moment.
  • xorcist 11y ago
    I would think it's not only feasible, but also more simple than what the Great Firewall already does. You could probably do it on on 0.1% of the NSA's yearly budget. (Which, after some Googling, turns out to be 10M USD. That's even more than I expected.)
    • dcposch 11y ago
      10B, not 10M!
• JohnTHaller 11y ago
  That's what I was referring to. It's easier in some countries than others.