Hacker News Reader

That would just stop their browsers from working in Kazakhstan on HTTPS sites, who would most likely respond by issuing a new certificate and/or recommending IE. It may also discourage websites from implementing HTTPS.

Not sure how this will work with certificate pinning, though. Will sites like Google become inaccessible?

View on HN

No, because locally-installed certificates override pins.

Depends on how the app is implemented. Doesn't have to be that way at all, and shouldn't if properly pinned.

Individual applications (not browsers) can of course hardcode pins that aren't overridden. Those applications will simply stop working in Kazakhstan.

Depends on the client implementation. You should expect applications like Twitter for iOS to become inaccessible as it pins the certificate (correctly), i.e. adding the world of (rogue) CA's still wouldn't make the certificate valid. Apart from replacing the (hardcoded properties of the) certificate

Reply on news.ycombinator.com