Hacker News Reader

Comment by lone_haxx0r | Hacker News Reader

> Mozilla doesn't think the state should meddle in your relationship with them, or the rest of the Internet.

I don't want to have a relationship with Mozilla. I use their browser to communicate with other people. The browser is merely a tool, and I would expect it to allow me to communicate with anyone I want (as long as it's technically feasible), not only people that Mozilla approves of.

View on HN

What's your point? Mozilla and Google here are preventing the government bogus CA from being used to bypass encryption. You can talk to whoever you want, and in full safety (as opposed to doing so while being spied by a tyrannical government like Kazakhstan).

Advocating for the devil here.

Installing a cert in the local root store means 'I fully trust the owner of this certificate'. It is an intentional feature of TLS to use this to be able to consensually MitM a TLS connection.

Yet here, western companies have decided that, regardless of whether the user wants to be Man in the Middle -ed by Kazakhstan, they simply cannot. This is inherently a political and not a technical decision. What Kazakhstan is doing is not actually breaking TLS, but instead using a feature.

I guess the real problem is that it's not immediately obvious to non-technical users what the implications are of installing a government-issued MITM CA certificate.

That could potentially be fixed with better UI, but even then it's rather hard to communicate the danger when the user is under the influence of a social engineering attack from their own ISP. (E.g. "This certificate is needed to ensure your security. Just ignore that warning from your browser, it's not important.)

I'm all for improving communication with user. But blacklisting certificate does nothing but harm.

This is not a social engineering attack, or at least it need not be. It is simply made a requirement; block any connections to the outside that do not use the certificate. Then people have a choice of no HTTPS (which blocks many big sites) or HTTPS that is MitMed by the government.

Incidentally, the above is why the 'consensual MitM-ing through a root-Cert is a feature of TLS' does not hold op. It is not consensual, it is not even coerced, it is a hard requirement. You could then go into an argument about national sovereignty / complying with local laws, but that is a totally different argument.

If I want to talk to the tyrannical government using their CA, I can't do it using Chrome or Firefox.

Look, I'm as pro-freedom as they come and I'm against coercing people to install certificates, but I also think good tools don't leverage their popularity to push their political opinions, even if I agree with those opinions. Good tools allow their user to do whatever is technically possible, even if the tool maker doesn't like that use-case.

The political and personal relationships of the user fall outside the realm of concern of the tool.

You want to give the government access to your encrypted data?

If I choose to install a certificate that is controlled by the government, yes, I definitely do want to give them access.

> credible reports that internet service providers in Kazakhstan have required people in the country to download and install a government-issued certificate on all devices and in every browser in order to access the internet

Hardly sounds like a choice.

Maybe for some it was a choice. Anyway, it's not the web browser's business.

If my anyone is coercing me to do something, it's a problem between that person and me. I don't want Mozilla lecturing me on politics, I just want to use the browser.

Mozilla can't make their own choices?

No one's coercing you into using their browser.

Sure, and we should be able to criticise their choices... Especially since they pride themselves on giving the user choice, freedom, bla bla bla.

This is lies. They did not require people to install anything. They MITMed only mobile internet. They MITMed only one city. On this city only few domains were MITMed. Only a fraction of connections to those domains were MITMed. So in practice I think that most people did not even notice anything. And those who noticed could just press F5 few times. Or use VPN as many people do anyway.

I don't, but maybe other people do.

I want the browser to let me make my own decisions regarding who I share my encrypted data with.

You trade this "relationship" for ease of access. Otherwise use curl or wget

Reply on news.ycombinator.com