3 ms·
Ask HN: Should every country have their own national CA certs?
We have so many regulations that force companies to store their customers’ data within the country, which makes sense from a perspective of privacy and security.
How do you feel about having a national CA certificate in every country?
How would someone feel living in authoritarian governments, knowing that the government can easily intercept and read many things?
How would a country feel that all the data of its people can be decrypted by another company? (most of the CAs are in the USA)
- theandrewbailey 2y agoSome already do. Take a look at your preferred trust store. > How would a country feel that all the data of its people can be decrypted by another company? This is not how PKI, as currently implemented, works.
- mohi-kalantari 2y agoIf someone has a trusted CA and has access to switches/packets, can't they do a MITM? I thought that's possible.
- theandrewbailey 2y agoYes, one would need access to both for that to be possible. A trusted CA alone (the topic of your question) is not enough.
- LinuxBender 2y agoThere are proxies that can dynamically generate certs based on requested domains so the only mitigating controls would be to either cache fingerprints of certs and alert someone if they are different than what other probe nodes are seeing from the rest of the internet or to pin certificates and hardly anyone does this any more. This is currently a manual process so most people would have no idea until it is too late. These would just be missing entries in the crt.sh logs.