2 ms·
see also, Russia's "SORM" system mandated for deep packet inspection appliance installation within ISP middle-mile networks. https://www.google.com/search?clie
by walrus01 5y ago
see also, Russia's "SORM" system mandated for deep packet inspection appliance installation within ISP middle-mile networks.
https://www.google.com/search?client=firefox-b-1-d&q=russia+SORM https://www.google.com/search?client=firefox-b-1-d&q=russia+...
Just very recently http/port 80 traffic in russia is now being redirected to a page trying to get people to download and trust a government run root CA for TLS, which would enable MITM of TLS1.2/TLS1.3 traffic.
https://bugzilla.mozilla.org/show_bug.cgi?id=1758773 https://bugzilla.mozilla.org/show_bug.cgi?id=1758773
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/QaKxfr5hOXg https://groups.google.com/a/mozilla.org/g/dev-security-polic...
- stefan_ 5y agoI think in the past when governments tried this route the response was browsers explicitly distrusting the certificate. I'll be getting my popcorn out to see if they have a spine because last time it was just Kazakhstan. See also: https://blog.mozilla.org/en/mozilla/mozilla-takes-action-to-protect-users-in-kazakhstan/ https://blog.mozilla.org/en/mozilla/mozilla-takes-action-to-...
- walrus01 5y agomozilla is generally good about these things, but what about browsers that use the operating system root CA trust storage? Mozilla is the only browser vendor that maintains their own root CA list independently. If you can get the operator of a windows 10/11 or MacOS device, or ios or android client device to insert a root CA into the OS trust store, then edge, chrome, and safari will trust it.
- stefan_ 5y agoChrome starts with the operating system CA store, but they have a large builtin list of revoked or otherwise blocked certificates: https://www.chromium.org/Home/chromium-security/crlsets/ https://www.chromium.org/Home/chromium-security/crlsets/