4 ms·

There's a bug open on BugZilla to get this new CA added to OneCRL: https://bugzilla.mozilla.org/show_bug.cgi?id=1680927 https://bugzilla.mozilla.org/show_bug.cg

by lol768 6y ago

There's a bug open on BugZilla to get this new CA added to OneCRL: https://bugzilla.mozilla.org/show_bug.cgi?id=1680927 https://bugzilla.mozilla.org/show_bug.cgi?id=1680927

politelemon 6y ago
I've tried finding my way through that Atlas Ripe website but it's very confusing. I don't know how others are able to pinpoint that problem so well.
- lol768 6y ago
  https://atlas.ripe.net/frames/measurements/28334941/#!probes https://atlas.ripe.net/frames/measurements/28334941/#!probes is showing you that, for a v4 connection to twitter.com, probe 6745 is getting back a TLS cert which does not match the cert provided to the majority of other probes. If you expand the row you can see the nation state MitM: notice the O=ISCA, C=KZ.
bzb6 6y ago
So what’s the point? If you don’t trust the certificate you won’t be able to browse the internet at all.
- strogonoff 6y ago
  I think it's either consciously let users to browse the Web over HTTPS and see green locks everywhere while effectively being MITM’d (undermining the point of encrypted connection), or ban each compromised certificate (making the Web difficult or impossible to access for folks in this situation). The remaining alternative is not defaulting to HTTPS for cases like non-sensitive static sites, which would be an unpopular proposition with some objective downsides.
- lol768 6y ago
  > So what’s the point? If you don’t trust the certificate you won’t be able to browse the internet at all. If all the major browser vendors do this it makes Kazakhstan's position quite difficult.
  - wyldfire 6y ago
    Unless they decide to cat-and-mouse: issue a new one.
    - Wowfunhappy 6y ago
      Every time they issue a new certificate, they need to get every single user to install it, whereas it should only take a moment for the browser vendors to block it. I would think it's pretty clear who has the upper hand there. They would be better off releasing some fork of Chromium—which is, unfortunately, also a thing they can presumably do...
    - m-p-3 6y ago
      The browser vendors could stop trusting O=ISCA, C=KZ entirely.
- mimi89999 6y ago
  The point is that if browsers block the cert it will make the MITM impossible without them releasing thieir own browser. It will be much more clear for normal uaers that the custom browser can intercept internet traffic than that "security certificate". Also good luck getting that browser into the AppStore and PlayStore or making users install the apk.

by lol768 6y ago

There's a bug open on BugZilla to get this new CA added to OneCRL: https://bugzilla.mozilla.org/show_bug.cgi?id=1680927 https://bugzilla.mozilla.org/show_bug.cgi?id=1680927

politelemon 6y ago

I've tried finding my way through that Atlas Ripe website but it's very confusing. I don't know how others are able to pinpoint that problem so well.

lol768 6y ago
https://atlas.ripe.net/frames/measurements/28334941/#!probes https://atlas.ripe.net/frames/measurements/28334941/#!probes is showing you that, for a v4 connection to twitter.com, probe 6745 is getting back a TLS cert which does not match the cert provided to the majority of other probes. If you expand the row you can see the nation state MitM: notice the O=ISCA, C=KZ.

bzb6 6y ago

So what’s the point? If you don’t trust the certificate you won’t be able to browse the internet at all.

strogonoff 6y ago
I think it's either consciously let users to browse the Web over HTTPS and see green locks everywhere while effectively being MITM’d (undermining the point of encrypted connection), or ban each compromised certificate (making the Web difficult or impossible to access for folks in this situation). The remaining alternative is not defaulting to HTTPS for cases like non-sensitive static sites, which would be an unpopular proposition with some objective downsides.
lol768 6y ago
> So what’s the point? If you don’t trust the certificate you won’t be able to browse the internet at all. If all the major browser vendors do this it makes Kazakhstan's position quite difficult.
- wyldfire 6y ago
  Unless they decide to cat-and-mouse: issue a new one.
  - Wowfunhappy 6y ago
    Every time they issue a new certificate, they need to get every single user to install it, whereas it should only take a moment for the browser vendors to block it. I would think it's pretty clear who has the upper hand there. They would be better off releasing some fork of Chromium—which is, unfortunately, also a thing they can presumably do...
  - m-p-3 6y ago
    The browser vendors could stop trusting O=ISCA, C=KZ entirely.
mimi89999 6y ago
The point is that if browsers block the cert it will make the MITM impossible without them releasing thieir own browser. It will be much more clear for normal uaers that the custom browser can intercept internet traffic than that "security certificate". Also good luck getting that browser into the AppStore and PlayStore or making users install the apk.