3 ms·

I've wondered about other providers. I never used SurfShark, but someone I know did, so I checked it out. I still haven't gotten any response from SurfShark ab

I've wondered about other providers. I never used SurfShark, but someone I know did, so I checked it out. I still haven't gotten any response from SurfShark about why they insist that users install a root SSL certificate and why their service can't be used without it. That alone should be incredibly scary. Installing a cert for negotiation between my computer and my provider's is one thing, but installing a cert that lets my provider spoof any SSL / TLS they want is something else entirely.

croutonwagon 4y ago
I agree with you entirely. Ideally their client would allow for you to accept or even better pre-load a cert they allow. But some OS's can be finicky about trusting certs that arent loaded into some central trust store that in principle allows you some ability to ensure everything trust IS trustworthy, but also de-facto means a cert trust can be abused. However thats as true for the google certs, or the Gov certs that are already pre-loaded and updated with OS updates etc as it would be for that service. And rarely are people actually looking at trust chains for the sites/services they use. That said, i would trust google or even the NSA/gov over some rando vpn provider, if for no other reason than its on literally every install and there are millions of preying eyes watching.