8 ms·

Ask HN: Don't you think, revoking SSL cert for some Russian banks was too much?

39 points by eimrine 5y ago

This topic has been appeared on HN [1] but has zero comments while on Russian tech websites this topic has the most discussions [2] among all the sanctions. From my point of view, and from point of view of literally everybody on [2], this is an attack on the freedom of speech since https became kind of mandatory for every website. Do we really need organisations like Thawte to be a moral judge of what website deserves to be visited securely? [1] https://news.ycombinator.com/item?id=30517483 [2] https://habr.com/en/post/654633/

codedokode 5y ago
This was a stupid decision. Thawte is helping Russian government here and gives them a valid excuse to force switching Russian internet to national-issued certificates. It won't hurt Russian economy or Russian army.
adriancr 5y ago
> We are required to comply with applicable laws and industry standards, including international sanctions and export controls. Your certificate was flagged as not being compliant with current trade sanctions. As such, we have revoked your certificate. Did you even read your articles?
- rvz 5y ago
  I hope you have read the guidelines from: [0] > Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that." As for the certificate. Looks like private platforms doing private platform things. [0] https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
viraptor 5y ago
> Do we really need organisations like Thawte to be a moral judge of what website deserves to be visited securely? I'm not sure how you got to that question from Thawte establishing they can't legally do business with a given customer. There's lots of other providers, many of them domestic for that bank - there's nothing about them "deserving" secure connections. One of the CAB rules for revocation seems to apply perfectly too: > The CA is made aware that a Subscriber has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use I'm sure "legally can work with you" is one of conditions listed in those two. (Or will be soon) Edit: I realised there's also a practical reason why the bank would want the revocation - if Thawte can't work with them anymore, they could have issues reporting a key compromise / triggering revocation themselves.
- ClumsyPilot 5y ago
  > Subscriber has violated one or more of its material obligations under the Subscriber Agreement I don't see the relevance - what has the bank violated? If someone introduces sanctions agaonst you, that's your not action or inaction, so this clause can't apply. Ofcourse sanctions override contracts, I am not clear if revoking certificates was legally nessesary but I don't think it's right. Suppose your money was in that bank and you need to buy insulin - should you die because of what the government did? Suppose you are an immigrant from Kazakhstan, it's not even your government. I don't think this 'press sanctions on ordinary people and hope for regime change' ever worked, dictatorships from Iran to North Korea seem to survive under sanctions
  - manofmanysmiles 5y ago
    > Suppose your money was in that bank and you need to buy insulin - should you die because of what the government did? At some point, more people will realize that governments do not exists, and actions done in the name of “authority” are inherently wrong. > Ofcourse sanctions override contracts, I am not clear if revoking certificates was legally nessesary but I don't think it's right. What makes you so sure of this? Why should the decisions of a few people (the government) be able to affect private agreement between two other people?
    - deleted 5y ago
      [deleted]
  - viraptor 5y ago
    There are alternative services for certificates. Serious institutions often hold multiple certificates from different sources so there's no extra waiting time to switch in an emergency. I'm not arguing anything political / moral here. If they can't recover from this situation quickly, they should not be trusted with money or relied on in emergency the first place. Your card payments don't go through the bank's pubic website, so the emergency payment situation is not realistic either Thawte's TOS specifically includes: compliance with local laws, with export controls, and allows dropping the agreement in case of force majeure which includes war, armed conflict, terrorism, etc. So they have multiple reasons to drop the bank.
csdvrx 5y ago
I do. There's a difference between refusing to further conduct business and sabotaging existing business.
troydavis 5y ago
Keep in mind that, while you're comparing this to nothing (the way things were a month ago), most of the rest of the world is comparing this to a war between Russia and multiple nuclear-armed nations. Re-frame things around war as an alternative, like "The CA revoked our cert, but at least nobody is dropping bombs on us." The negatives will be easier to understand and accept.
5ESS 5y ago
I’m against web censorship wholesale. Registrars and hosts and certificate authorities shouldn’t have revoked any existing contracts. But they would be within their rights to disallow renewal. And I hope to see people like “NameCheap CEO” who cancelled .RU domains on short notice without giving users enough time to transfer their domains-pulling the rug out from under them..sued for criminal contract breach.
- rosndo 5y ago
  > sued for criminal contract breach. I don’t think you even know what these words mean.
- ricardobeat 5y ago
  I don’t know if I agree with that second part, but yes, it’s a shame we ever crossed that line. Easily exercised censorship like this is a lot more damaging than, say, trying to ban a zine or newspaper; and will inevitably be used for the wrong purposes in the future.
  - 5ESS 5y ago
    Domains are expected to be set up to stay online without intervention for years(1-10 years + even) it’s not right to yank domains away in a couple weeks time span just to virtue signal your support for the anti-Russia agenda. Some of these domains are probably used for internal services for hospitals, medical equipment, domestic transit, electricity grid, telecommunications and more so when you fuck with domains it causes all sorts of problems for real people who had nothing to do with the invasion of Ukraine (which arguably Ukraine started, contrary to the msm message, Ukraine allegedly bombed schools and homes for 8 years in DPR) interview with civilians on Patrick Lancasters channel seem to support the claim that Ukraine was the aggressor.
    - ricardobeat 5y ago
      I see. Again, totally agree that it is wrong to yank domains away, but not at all with your 'virtue signalling' and causing 'problems for real people' or 'anti-russian agenda' (Russia is destroying an entire country as we speak, there is no hidden agenda needed). Invading and bombing a country causes "problems for real people". Ukraine didn't invade Russia. Ukraine didn't start a conflict in the DPR either, Russia invaded Crimea while fuelling the separatists in Donbas. The world doesn't forget. I can't believe you eat up the idea that Ukraine is the aggressor. But also don't this is a place I'd like to discuss this topic. Farewell.
uberman 5y ago
It is hypocritical to claim that a client (the bank) should have protected speech at the expense of the provider. A company choosing not to do business with someone seems to be a much strong free speech claim in my opinion. So if free speech is the hill you want to die on, you need to support Thawte.
- anamax 5y ago
  > A company choosing not to do business with someone seems to be a much strong free speech claim in my opinion. If my business chooses to not do business with "those people", you're okay? Or, does it depend on which "those people"? Note that current US law says that businesses can't refuse to do business"those people" for certain definitions of "those people."
  - bjourne 5y ago
    I believe that only applies to the hospitality business, doesn't it? A B2B company could refuse to do business with a company for any reason, including the skin color of that company's ceo. Furthermore, "those people" very much excludes nationality otherwise the sanctions against Iran would have been unconstitutional.
    - anamax 5y ago
      > I believe that only applies to the hospitality business, doesn't it? Nope - while 42 U.S.C. §2000a was "public accommodations", it isn't the only law in this area. > Furthermore, "those people" very much excludes nationality otherwise the sanctions against Iran would have been unconstitutional. Nope on three levels. The first one is that the groups protected by 42 USC (and the other laws) are "race, color, religion, or national origin and it's tough to see how that doesn't cover nationality. The second one is that the laws for the first part aren't part of the constitution. The third one is the regulation/law in question did NOT say anything about race. It said you can't do business with Iranian-country entities and had the "notwithstanding" boilerplate, creating an exemption to the other laws, an exemption limited to Iranian-country entities. That exemption did NOT cover Iranians without the country connection.
bravetraveler 5y ago
It's a bit much in terms of... feigned malice. What I mean by that is, it should be trivial for these organizations to both find an in-country vendor, but also rotate a certificate/keypair. It's entirely punitive yet (I imagine) ineffective. I understand halting business with a region given they probably aren't sure they'd be paid with the ever-growing sanctions
bell-cot 5y ago
Generically, yes. (So - ignoring details of Thawte's legal situation, etc.) Sanctions, supporting Ukraine in various ways, etc. should be intelligently used tools, with an informed, competent, long-term strategy behind their use. A lot of what's happening now feels more like "millions of 3-year-olds are really mad at Russia, so they each scream loudly, grab whatever thingie is close at hand, and bash really hard on Russia". Great for venting and follow-the-crowd virtue signaling. Probably far less useful for achieving reasonable strategic goals.
- Chyzwar 5y ago
  Strategic goal is collapse of Russian's economy. All these actions by Western companies contributing more than initial sanctions on oligarchs. For most companies, early exit from Russia market is a good idea. They avoid tarnishing theirs reputation and Russia market is already half-dead. Even if Putin die today, these companies will not come back anytime soon. Russia just did 30 years reset.
  - bell-cot 5y ago
    > Strategic goal is collapse of Russian's economy. Ah. Is that the (sole) strategic goal, or is that a tactical threat - which many people believe useful for "improving" the situation? And perhaps also a feels-good, looks-good bandwagon that lots of people want to jump on at the moment? I'm thinking that most of the grown-up western leaders have a list of actual strategic goals, which looks more like this: - No nuclear weapons used, especially not at scale, nor against my country. - No nuclear weapons "lost" (to parties unknown) in a chaotic break-up of Russian state authority. - No massive/widespread economic collapses, wars, famine, etc. resulting in very large (say, 1+ million) deaths. Nor (say) 10+ million refugees. - No "large, ongoing" failed state situations. - Russian's invasion of Ukraine clearly fails (short- or long-term) in the eyes of most Russian government & military leaders. Ditto most autocratic leaders in other nations, who might be tempted to stage invasions of their own. - Ukraine and its people are freed from Russian occupations / attacks / threats, and have a good opportunity to rebuild...preferably not too far in the future. - My, my party's, and my government's situations are improved (or at least not seriously degraded) by events related to Russia's invasion of Ukraine. - Etc.
mattbrewsbytes 5y ago
> this is an attack on the freedom of speech Freedom of Speech is not universal in every country. People are jailed for speaking against their government in some countries. The Terms of Service agreement, which nobody reads, probably has some legal mumbo jumbo in there that lets the provider terminate services on moral/ethical grounds as they see fit. So like if someone gets a cert for an illegal gambling website they can terminate it at will. They may also have clauses related to encryption levels and should there be sanctions on software encryption for certain countries they could be forced to revoke services.
peanut_worm 5y ago
Compared to bombing super markets?
burntoutfire 5y ago
Too much compared to what? Surely not to killing thousands of innocent people?
- eimrine 5y ago
  Whataboutism [1] is usually expected not from the party I am talking to. [1] https://en.wikipedia.org/wiki/Whataboutism https://en.wikipedia.org/wiki/Whataboutism
nsonha 5y ago
Sanction works over long term, so while this will definitely help bring down Putin's regime, it won't have any impact to this war which hopefully will end soon with some sort of treaty. If it turns out like that, I hope that western countries learn the lesson next time and don't do such abrupt sanctions (because it won't work right away anyway). We have not heard much from inside Russia but they sure causes a lot of chaos that I think is unnecessary. Some people even think it's OK to cut Internet, DNS and other critical services, you understand that emergency services and hospitals need them and that could cost human lives?
mib32 5y ago
Noe
Gravyness 5y ago
I don't think it matters whether this or anything else is an attack of "freedom of speech" in this war. These arguments might be right but it will take a lot of time to change someone's mind when they already decided Russia is the bad guy. This war moves much faster than this kind of precise dialog, which means faster strategies like "get as much hate towards the opponent as fast as possible" is going to be more fruitful. So things like propaganda, fake news, fake videos and photos, etc. Artillery just isn't as effective as convincing people, and companies, to fight your side on the war. Now, if you just want to debate what is right or wrong, then I agree, it's an attack of freedom of speech, especially if it was done without warning.

Chyzwar 5y ago
> Ah. Is that the (sole) strategic goal, or is that a tactical threat - which many people believe useful for "improving" the situation? And perhaps also a feels-good, looks-good bandwagon that lots of people want to jump on at the moment? Economic collapse in Russia would result in: Putin losing power, Russia losing war or at least retreat from Ukraine. Most likely, multiple bigger civil war started in Russia Federation. > I'm thinking that most of the grown-up western leaders have a list of actual strategic goals, which looks more like this: > - No nuclear weapons used, especially not at scale, nor against my country. > - No nuclear weapons "lost" (to parties unknown) in a chaotic break-up of Russian state authority. That why West can only help Ukraine indirectly and fight suing economic sanctions. > - No massive/widespread economic collapses, wars, famine, etc. resulting in very large (say, 1+ million) deaths. Nor (say) 10+ million refugees. > - No "large, ongoing" failed state situations. Russia proven that they are European bandits and cannot be trusted. Nobody in EU will care about future of Russia. > Russian's invasion of Ukraine clearly fails (short- or long-term) in the eyes of most Russian government & military leaders. Ditto most autocratic leaders in other nations, who might be tempted to stage invasions of their own. You underestimate propaganda efforts. Most Russian still believe in military peace keeping action Donbas. Reality distortion is very strong there, sanctions are helping to get the message across. > - Ukraine and its people are freed from Russian occupations / attacks / threats, and have a good opportunity to rebuild...preferably not too far in the future. It is not so clear-cut. Once Belarus joins the war and French and German interest betray Eastern Europe, we can expect half of Ukraine lost and EU failing apart. > - My, my party's, and my government's situations are improved (or at least not seriously degraded) by events related to Russia's invasion of Ukraine. Most of Eastern Europe will benefit from the current situation.