3 ms·

> Comcast can just start demanding that their customers install their root cert and that's that. Comcast can demand all they want but they are going to have to

> Comcast can just start demanding that their customers install their root cert and that's that. Comcast can demand all they want but they are going to have to hand hold a lot of people though the process. Sure Windows/Mac could offer a nice executable to install it for you but you still have to get people to install it and that’s not something there while customer base will be able to do. The process of installing CA’s on iOS devices involves even more steps. And this is a process that will have to be completed every time an new device is put on their network. What about even more “locked down” systems? Your IoT doorbell? Your networked cctv camera? Your Smart TV? Is it possible? Sure. Is it practical? If kazakhstan couldn’t do it I’m going to struggle to see Comcast pull it off (though if anyone can, it’s prob them). See in a Corp environment where they own all the devices it’s fairly easy to do as most of your deployed hardware if going to be able to remote install what IT asks of them, your mobile devices are going to be enrolled into MDM’s and you will have IT staff on hand to help staff enroll their devices. None of which Comcast have. We are not talking about your avg hacker news reader configuring their devices to get online, we are talking about people like my mother who can just about browse the web and play games on her iPad and struggles to set the alarm on it. How you going to get her to install the rootca without having some do it for her? Sure get the installer to do it? But what about all your existing customers? You going to schedule a call out for each of them? And what about when she gets a new device? You going to make her take the device to the local Comcast store to get it installed? Oh and Chrome and or Firefox could throw a massive spanner into the works by refusing to accept their root cert half way though deployment meaning all those “updated devices’ need to be updated again before they even had a chance to use it at any major scale. Sure it’s possible, I just don’t see it as practical as of today.

izacus 9y ago
You're way overthinking this. Go look at how exactly the automated deployment of MITM HTTPS corporate firewall works - it's a few steps affair and gets them 90% there. All they need to do is block YouTube/Google/Facebook until you run the "Comcast internet setup wizard" (remember? those were a thing!) which makes most customer connections MITMable. Then charge extra for all non-MITMed connections ;) Declare Firefox as unsupported, Google will have to cave in to the biggest telco and that's that. This article (and all others about Comcast) clearly proves that Americans have zero leverage over companies like Comcast. The customers are peacfully accepting modification of their network traffic now, why do you think you'll suddenly get any more leverage over a natural monopoly you're forced to use in the future? Especially after dismantling net neutrality?
- Crosseye_Jack 9y ago
  The internet setup wizard is a pain to even get to these days esp if you are trying to run it on a “dirty” device that has already been used online and is enforcing HSTS. You can only redirect them to the wizard if they try and connect to a non https site or the non http site of a https site they have yet to visit. Same mother. She has a 4g sim in her iPad cheapest deal for her usage level is prepaid sims. When the prepaid credit is gone it’s cheaper to use an new sim than top up the exisiting sim. Except you have to go though a activation portal to enable the sim. It’s easy. Pop in the new sim, visit telcos website or any non https valid domain press the active button and away you go. She still can’t do it. And in a world where more and more people are using apps instead of browsers where preinstalled apps will just fail you are gonna not to cause even more issues. BTs Smart Setup captive portal on their routers was one of the most annoying things they did. And when searching for it the top results are for turning the thing off. Why? Because it interferes with devices that can not display the portal, Smart TVs, Amazon TV sticks, Settop boxes, webcams, IoT toasters, etc. While they haven’t removed it from their latest router they have had to make disabling it much easier than in previous versions. With the number of end user devices on the market, I just don’t see them managing to pull it off by getting end users to install their cert. But you touch on a point. You say that Chrome would have to just suck it up from Comcast. Now I’m not saying I disagree, but why would Comcast go though all that pain to get end users to install a root ca if they held so much power over Chrome (the largest browser my customers use) then why not just get the browser to install the cert anyway and save all that hassle with your end users. Think of the savings they would make not having to handle all those support calls. Like I said. Possible? sure, practical today? I don’t believe so.
robin_reala 9y ago
I remember Kazakhstan announcing that policy, but I never saw the fallout. Did anyone write it up in English?
- Crosseye_Jack 9y ago
  They tried a couple of times (not been keeping tabs on them too closely) to get a root cert into Mozilla - https://bugzilla.mozilla.org/show_bug.cgi?id=1232689 https://bugzilla.mozilla.org/show_bug.cgi?id=1232689 but were denied until they get a valid BR audit, https://bugzilla.mozilla.org/show_bug.cgi?id=1331364 https://bugzilla.mozilla.org/show_bug.cgi?id=1331364 But has yet to answer the follow up questions so the request hasn't progressed. They published a response to the backlash - http://mic.gov.kz/en/news/matters-using-registration-certificates-national-certification-authority-republic-kazakhstan http://mic.gov.kz/en/news/matters-using-registration-certifi... saying that it would only be used to improve the security when accessing foreign resources, battle porn terrorism and transnational crime. Dunno what the adoption rate of the cert was or if they do force the use of the cert when accessing foreign https sites They quietly removed the notice off the telecom's websites saying that people will need to install the cert or may lose access to foreign https sites (not from kazakhstan) but I would expect someone would of gotten word out if they had (Maybe they did and i've just not come across it).

izacus 9y ago

You're way overthinking this. Go look at how exactly the automated deployment of MITM HTTPS corporate firewall works - it's a few steps affair and gets them 90% there. All they need to do is block YouTube/Google/Facebook until you run the "Comcast internet setup wizard" (remember? those were a thing!) which makes most customer connections MITMable. Then charge extra for all non-MITMed connections ;) Declare Firefox as unsupported, Google will have to cave in to the biggest telco and that's that. This article (and all others about Comcast) clearly proves that Americans have zero leverage over companies like Comcast. The customers are peacfully accepting modification of their network traffic now, why do you think you'll suddenly get any more leverage over a natural monopoly you're forced to use in the future? Especially after dismantling net neutrality?

Crosseye_Jack 9y ago
The internet setup wizard is a pain to even get to these days esp if you are trying to run it on a “dirty” device that has already been used online and is enforcing HSTS. You can only redirect them to the wizard if they try and connect to a non https site or the non http site of a https site they have yet to visit. Same mother. She has a 4g sim in her iPad cheapest deal for her usage level is prepaid sims. When the prepaid credit is gone it’s cheaper to use an new sim than top up the exisiting sim. Except you have to go though a activation portal to enable the sim. It’s easy. Pop in the new sim, visit telcos website or any non https valid domain press the active button and away you go. She still can’t do it. And in a world where more and more people are using apps instead of browsers where preinstalled apps will just fail you are gonna not to cause even more issues. BTs Smart Setup captive portal on their routers was one of the most annoying things they did. And when searching for it the top results are for turning the thing off. Why? Because it interferes with devices that can not display the portal, Smart TVs, Amazon TV sticks, Settop boxes, webcams, IoT toasters, etc. While they haven’t removed it from their latest router they have had to make disabling it much easier than in previous versions. With the number of end user devices on the market, I just don’t see them managing to pull it off by getting end users to install their cert. But you touch on a point. You say that Chrome would have to just suck it up from Comcast. Now I’m not saying I disagree, but why would Comcast go though all that pain to get end users to install a root ca if they held so much power over Chrome (the largest browser my customers use) then why not just get the browser to install the cert anyway and save all that hassle with your end users. Think of the savings they would make not having to handle all those support calls. Like I said. Possible? sure, practical today? I don’t believe so.

robin_reala 9y ago

I remember Kazakhstan announcing that policy, but I never saw the fallout. Did anyone write it up in English?

Crosseye_Jack 9y ago
They tried a couple of times (not been keeping tabs on them too closely) to get a root cert into Mozilla - https://bugzilla.mozilla.org/show_bug.cgi?id=1232689 https://bugzilla.mozilla.org/show_bug.cgi?id=1232689 but were denied until they get a valid BR audit, https://bugzilla.mozilla.org/show_bug.cgi?id=1331364 https://bugzilla.mozilla.org/show_bug.cgi?id=1331364 But has yet to answer the follow up questions so the request hasn't progressed. They published a response to the backlash - http://mic.gov.kz/en/news/matters-using-registration-certificates-national-certification-authority-republic-kazakhstan http://mic.gov.kz/en/news/matters-using-registration-certifi... saying that it would only be used to improve the security when accessing foreign resources, battle porn terrorism and transnational crime. Dunno what the adoption rate of the cert was or if they do force the use of the cert when accessing foreign https sites They quietly removed the notice off the telecom's websites saying that people will need to install the cert or may lose access to foreign https sites (not from kazakhstan) but I would expect someone would of gotten word out if they had (Maybe they did and i've just not come across it).