6 ms·
It's bad that there are enough plain http connections for this to be possible.
by thepete2 7y ago
It's bad that there are enough plain http connections for this to be possible.
- deleted 7y ago[deleted]
- mminer237 7y agoAlthough Baidu does still default to HTTP, the Chinese government has the root certificates for every Chinese certificate authority. It can MITM traffic for anybody in China, even over HTTPS, so that wouldn't solve the problem.
- deleted 7y ago[deleted]
- cryptozeus 7y agoWow really? Any source for this ? That is like everyone can lock their house but gov has the master key.
- mminer237 7y agoI suppose I probably overstated the situation a bit. The PRC National Intelligence Law ( http://cs.brown.edu/courses/csci1800/sources/2017_PRC_NationalIntelligenceLaw.pdf http://cs.brown.edu/courses/csci1800/sources/2017_PRC_Nation... ) requires, "Any organization or citizen shall support, assist and cooperate with the state intelligence work...", and China was observed making its own certificates for foreign sites before this ( https://news.ycombinator.com/item?id=5124784 https://news.ycombinator.com/item?id=5124784 ), but there's no direct evidence that China actually has all the root certificates currently or has used them maliciously. Of course, the law requires citizens to preserve secrecy and Westerners can't observe what China is doing, so that wouldn't be unexpected.
- dehrmann 7y agoDo browsers and OSes trust Chinese CAs?
- mminer237 7y agoGenerally, yes. In 2015 CNNIC's new certs were removed from most browsers after they gave an Egyptian security company an Intermediate CA certificate for internal use that got leaked to the public. But that was for incompetence more than malice, and I think everyone's accepted them back now. It is worth noting that there haven't been any observed cases of China abusing their CA certificates in the last few years, but it's hard for Westerners to monitor what is going on inside China.