4 ms·

> I think this CA should be blacklisted by Mozilla and Firefox should not accept it at all even user installed it manually. > This will save privacy of all Int

> I think this CA should be blacklisted by Mozilla and Firefox should not accept it at all even user installed it manually. > This will save privacy of all Internet users in Kazakhstan. No. This will mean that users would simply switch to chrome, edge, brave, ... , n + 1. In case all of them block this CA, the government will force people to install an older version or will patch any open source browser so that it works with their certificates. IMO, this is also wrong from a philosophical point of view. Your browser should just be your browser and not take part in political disputes. It doesn't sit well with me that Firefox has anything to say in the politics of its users. And finally, encryption doesn't solve violence.

taftster 7y ago
Yes, exactly. In the United States, for example, it's legal (even expected?) that corporations can install custom CAs into their user's browsers and prevent internet access to any browser without it installed. Is it Mozilla's job to prevent these CAs from being installed on user's workstations? Should Mozilla reject any certificate from Blue Snort, etc.? Kazakhstan has likewise declared it legal (under their own sovereign legal authority) to prevent web access to its citizens without the required CA installed. Just like it's legal in the US for corporations to "spy" on their employees, it's legal in Kazakhstan for it to spy on its citizens. Laws of Western countries do not extend into other sovereign nations, regardless of what one thinks of those laws. It's not Mozilla's job to get involved in this case. > And finally, encryption doesn't solve violence. Nor abuse of freedom by nation states, unfortunately.
- jeroenhd 7y ago
  American and European companies and organisations put on loads of protest against acts like SOPA and Article 13. I don't see why this is any different. Just because a nation state decides on something doesn't mean that foreign entities can't protest that decision. Firefox and Chrome can add very scary warnings to users about government sabotage if they want to; they can even start including ads for Tor and comparable services if they want to. Blocking the cert would at most be very consumer-unfriendly to people wanting the certificate to be in place. If they disagree with a particular browser vendor, those people can switch browsers or fork an open source one. Mozilla's job is to provide a safe and open web. The Kazakh government is opposing that. In this case, it's perfectly in line with Mozilla's mission to warn users as best they can against the scary precedent their government is setting. Of course this only works well if Google, Microsoft and Apple join the effort to warn users. Google is already showing a constant warning on Android when a device is being MitM'd and many of their apps do certificate pinning. Facebook and Twitter do certificate pinning in their apps as well. I don't see why browsers couldn't take action as well. Just don't show any green locks during a MitM and show periodic notifications about the users' security being compromised. Block the certificate if you have to; as a party people rely on for choosing what certificate authorities to trust, they can't allow themselves to be compromised by governments enforcing laws endangering the safety of the web.
effie 7y ago
You're forgetting the power a discontent population can have on government. In case all browsers took a stance against cooperating with silent MITM, this would be a great pressure on powerful entities not to do it. Governments can get away with suppressing people's online experience for a while, but if they have subpar experience and basic websites won't function properly due to dated browsers, the pressure on governments to get modern browsers may increase.
fragmede 7y ago
Given the rise of HTTPS, intentionally or unintentionally, politics now lives in the endpoint (smartphone/tablet/computer)'s tech stack. Some part - the browser (and thus its vendor), the operating system (and its vendor), or some add-on (and thus its vendor) - gets to determine who/what's considered a root CA, and is thus allowed to decrypt message contents.

taftster 7y ago

Yes, exactly. In the United States, for example, it's legal (even expected?) that corporations can install custom CAs into their user's browsers and prevent internet access to any browser without it installed. Is it Mozilla's job to prevent these CAs from being installed on user's workstations? Should Mozilla reject any certificate from Blue Snort, etc.? Kazakhstan has likewise declared it legal (under their own sovereign legal authority) to prevent web access to its citizens without the required CA installed. Just like it's legal in the US for corporations to "spy" on their employees, it's legal in Kazakhstan for it to spy on its citizens. Laws of Western countries do not extend into other sovereign nations, regardless of what one thinks of those laws. It's not Mozilla's job to get involved in this case. > And finally, encryption doesn't solve violence. Nor abuse of freedom by nation states, unfortunately.

jeroenhd 7y ago
American and European companies and organisations put on loads of protest against acts like SOPA and Article 13. I don't see why this is any different. Just because a nation state decides on something doesn't mean that foreign entities can't protest that decision. Firefox and Chrome can add very scary warnings to users about government sabotage if they want to; they can even start including ads for Tor and comparable services if they want to. Blocking the cert would at most be very consumer-unfriendly to people wanting the certificate to be in place. If they disagree with a particular browser vendor, those people can switch browsers or fork an open source one. Mozilla's job is to provide a safe and open web. The Kazakh government is opposing that. In this case, it's perfectly in line with Mozilla's mission to warn users as best they can against the scary precedent their government is setting. Of course this only works well if Google, Microsoft and Apple join the effort to warn users. Google is already showing a constant warning on Android when a device is being MitM'd and many of their apps do certificate pinning. Facebook and Twitter do certificate pinning in their apps as well. I don't see why browsers couldn't take action as well. Just don't show any green locks during a MitM and show periodic notifications about the users' security being compromised. Block the certificate if you have to; as a party people rely on for choosing what certificate authorities to trust, they can't allow themselves to be compromised by governments enforcing laws endangering the safety of the web.

effie 7y ago

You're forgetting the power a discontent population can have on government. In case all browsers took a stance against cooperating with silent MITM, this would be a great pressure on powerful entities not to do it. Governments can get away with suppressing people's online experience for a while, but if they have subpar experience and basic websites won't function properly due to dated browsers, the pressure on governments to get modern browsers may increase.

fragmede 7y ago

Given the rise of HTTPS, intentionally or unintentionally, politics now lives in the endpoint (smartphone/tablet/computer)'s tech stack. Some part - the browser (and thus its vendor), the operating system (and its vendor), or some add-on (and thus its vendor) - gets to determine who/what's considered a root CA, and is thus allowed to decrypt message contents.