3 ms·

India's encryption laws require service providers to allow law enforcement to intercept, monitor and trace encrypted traffic. Encryption within India is limited

India's encryption laws require service providers to allow law enforcement to intercept, monitor and trace encrypted traffic. Encryption within India is limited by law to weak forms. https://www.eff.org/deeplinks/2021/07/indias-draconian-rules-internet-platforms-threaten-user-privacy-and-undermine https://www.eff.org/deeplinks/2021/07/indias-draconian-rules...

gruez 3y ago
Is this actually implemented? Do all browsers in india use weakened TLS or something?
- shmoe 3y ago
  Likely a governmental man-in-the-middle attack.
  - gruez 3y ago
    That's non-trivial to pull off without massive noise being generated by users. Even if you're able to somehow able to backdoor all domestic computers to install the government's root certificate, there's going to be a steady stream of complaints from foreigners coming in with their non-backdoored devices.
  - cortesoft 3y ago
    That means that either the government has a browser trusted root CA (which means they could spy on anyone in the world if they can MITM them), or they somehow force everyone in the country to install their trusted CAs.
    - shmoe 3y ago
      Who says they can't, but weak encryption is definitely an easier lift.
- A1kmm 3y ago
  I don't know if it is actually implemented, but note it could be either of the two endpoints that could cooperate to allow decryption - client (browser) or server. It is possible that Google is not allowed to operate in India unless they transmit all the keys to the government somehow. If they are forced to share the private key used for Youtube's certificates, that would allow effective MITM, or entirely passive surveillance if a non-ephemeral key suite is used. Google could also be required to send them every ephemeral key.
- subins2000 3y ago
  There is no such implementation in India. The major censorship in internet here is SNI based HTTPS filtering.

gruez 3y ago

Is this actually implemented? Do all browsers in india use weakened TLS or something?

shmoe 3y ago
Likely a governmental man-in-the-middle attack.
- gruez 3y ago
  That's non-trivial to pull off without massive noise being generated by users. Even if you're able to somehow able to backdoor all domestic computers to install the government's root certificate, there's going to be a steady stream of complaints from foreigners coming in with their non-backdoored devices.
- cortesoft 3y ago
  That means that either the government has a browser trusted root CA (which means they could spy on anyone in the world if they can MITM them), or they somehow force everyone in the country to install their trusted CAs.
  - shmoe 3y ago
    Who says they can't, but weak encryption is definitely an easier lift.
A1kmm 3y ago
I don't know if it is actually implemented, but note it could be either of the two endpoints that could cooperate to allow decryption - client (browser) or server. It is possible that Google is not allowed to operate in India unless they transmit all the keys to the government somehow. If they are forced to share the private key used for Youtube's certificates, that would allow effective MITM, or entirely passive surveillance if a non-ephemeral key suite is used. Google could also be required to send them every ephemeral key.
subins2000 3y ago
There is no such implementation in India. The major censorship in internet here is SNI based HTTPS filtering.