3 ms·

That is a wild claim. I can't imagine that being correct given how that's been abused in the past https://www.eff.org/deeplinks/2011/08/iranian-man-middle-atta

by hvb2 6mo ago

That is a wild claim. I can't imagine that being correct given how that's been abused in the past https://www.eff.org/deeplinks/2011/08/iranian-man-middle-attack-against-google https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att...

cookiengineer 6mo ago
> That is a wild claim China telecom regularly has BGP announcements that conflict with level3's ASNs. Just as a hint in case you want to dig more into the topic, RIR data is publicly available, so you can verify yourself who the offenders are. Also check out the Geedge leaked source code, which also implements TLS overrides and inspection on a country scale. A lot of countries are customers of Geedge's tech stack, especially in the Middle East. Just sayin' it's more common than you're willing to acknowledge.
ceejayoz 6mo ago
It's a pretty huge list. https://support.apple.com/en-us/126047 https://support.apple.com/en-us/126047 The chances of zero of these CAs having been compromised by state-level actors seems… slim. Do you trust "Hongkong Post Root CA 3" not to fuck with things? Your link's from 2011; the US government was still in the trusted list until 2018. https://www.idmanagement.gov/implement/announcements/04_apple_common_removal/ https://www.idmanagement.gov/implement/announcements/04_appl...
- nucleardog 6mo ago
  All modern browsers require certificates to be published in the certificate transparency logs in order to be considered valid. These are monitored, things do get noticed[0], and things like this can and have lead to CAs being distrusted. It's not foolproof, and it's reactive rather than proactive... but in general, this is unlikely to be happening on major sites or at any significant scale. I'd wholeheartedly recommend people taking some time and reading through the CA Compliance issues on Bugzilla. The entire CA program there, in my opinion, does a fantastic and largely thankless job of keeping this whole thing on the rails. It's one of the few things I can say I had _more_ trust in the more I looked into it. [0]: https://bugzilla.mozilla.org/show_bug.cgi?id=1934361 https://bugzilla.mozilla.org/show_bug.cgi?id=1934361
  - ceejayoz 6mo ago
    > It's not foolproof, and it's reactive rather than proactive… This just means you keep your powder dry until it's needed.

by hvb2 6mo ago

cookiengineer 6mo ago

> That is a wild claim China telecom regularly has BGP announcements that conflict with level3's ASNs. Just as a hint in case you want to dig more into the topic, RIR data is publicly available, so you can verify yourself who the offenders are. Also check out the Geedge leaked source code, which also implements TLS overrides and inspection on a country scale. A lot of countries are customers of Geedge's tech stack, especially in the Middle East. Just sayin' it's more common than you're willing to acknowledge.

ceejayoz 6mo ago

It's a pretty huge list. https://support.apple.com/en-us/126047 https://support.apple.com/en-us/126047 The chances of zero of these CAs having been compromised by state-level actors seems… slim. Do you trust "Hongkong Post Root CA 3" not to fuck with things? Your link's from 2011; the US government was still in the trusted list until 2018. https://www.idmanagement.gov/implement/announcements/04_apple_common_removal/ https://www.idmanagement.gov/implement/announcements/04_appl...

nucleardog 6mo ago
All modern browsers require certificates to be published in the certificate transparency logs in order to be considered valid. These are monitored, things do get noticed[0], and things like this can and have lead to CAs being distrusted. It's not foolproof, and it's reactive rather than proactive... but in general, this is unlikely to be happening on major sites or at any significant scale. I'd wholeheartedly recommend people taking some time and reading through the CA Compliance issues on Bugzilla. The entire CA program there, in my opinion, does a fantastic and largely thankless job of keeping this whole thing on the rails. It's one of the few things I can say I had _more_ trust in the more I looked into it. [0]: https://bugzilla.mozilla.org/show_bug.cgi?id=1934361 https://bugzilla.mozilla.org/show_bug.cgi?id=1934361
- ceejayoz 6mo ago
  > It's not foolproof, and it's reactive rather than proactive… This just means you keep your powder dry until it's needed.