Ask HN: Don't you think, revoking SSL cert for some Russian banks was too much? | Hacker News Reader

Ask HN: Don't you think, revoking SSL cert for some Russian banks was too much?

39 pointseimrine39 comments

This topic has been appeared on HN [1] but has zero comments while on Russian tech websites this topic has the most discussions [2] among all the sanctions. From my point of view, and from point of view of literally everybody on [2], this is an attack on the freedom of speech since https became kind of mandatory for every website. Do we really need organisations like Thawte to be a moral judge of what website deserves to be visited securely?

[1] https://news.ycombinator.com/item?id=30517483 [2] https://habr.com/en/post/654633/

View on HN

> Do we really need organisations like Thawte to be a moral judge of what website deserves to be visited securely?

I'm not sure how you got to that question from Thawte establishing they can't legally do business with a given customer. There's lots of other providers, many of them domestic for that bank - there's nothing about them "deserving" secure connections.

One of the CAB rules for revocation seems to apply perfectly too:

> The CA is made aware that a Subscriber has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use

I'm sure "legally can work with you" is one of conditions listed in those two. (Or will be soon)

Edit: I realised there's also a practical reason why the bank would want the revocation - if Thawte can't work with them anymore, they could have issues reporting a key compromise / triggering revocation themselves.

> Subscriber has violated one or more of its material obligations under the Subscriber Agreement

I don't see the relevance - what has the bank violated? If someone introduces sanctions agaonst you, that's your not action or inaction, so this clause can't apply.

Ofcourse sanctions override contracts, I am not clear if revoking certificates was legally nessesary but I don't think it's right.

Suppose your money was in that bank and you need to buy insulin - should you die because of what the government did?

Suppose you are an immigrant from Kazakhstan, it's not even your government.

I don't think this 'press sanctions on ordinary people and hope for regime change' ever worked, dictatorships from Iran to North Korea seem to survive under sanctions

There are alternative services for certificates. Serious institutions often hold multiple certificates from different sources so there's no extra waiting time to switch in an emergency. I'm not arguing anything political / moral here. If they can't recover from this situation quickly, they should not be trusted with money or relied on in emergency the first place.

Your card payments don't go through the bank's pubic website, so the emergency payment situation is not realistic either

Thawte's TOS specifically includes: compliance with local laws, with export controls, and allows dropping the agreement in case of force majeure which includes war, armed conflict, terrorism, etc. So they have multiple reasons to drop the bank.

> Suppose your money was in that bank and you need to buy insulin - should you die because of what the government did?

At some point, more people will realize that governments do not exists, and actions done in the name of “authority” are inherently wrong.

> Ofcourse sanctions override contracts, I am not clear if revoking certificates was legally nessesary but I don't think it's right.

What makes you so sure of this? Why should the decisions of a few people (the government) be able to affect private agreement between two other people?

“There's lots of other providers”

Are you sure about that? I took a look at the root certificates that are included in Firefox[0], and AFAICT none of them are located in Russia.

There are some Chinese CAs there though, so perhaps the Russian banks could use them instead.

[0] https://wiki.mozilla.org/CA/Included_Certificates

Precisely, having plenty of providers doesn't mean there is one in each country and most countries get by fine without a local provider.

If a country finds itself commercially banned by so many countries it can't get a certificate from any of them and by the time this has happened it hasn't been able to get a domestic CA vetted by the international community then trust is broken on a deeper level than the CA system is designed to handle and is going to fall apart for that region either way.

> We are required to comply with applicable laws and industry standards, including international sanctions and export controls. Your certificate was flagged as not being compliant with current trade sanctions. As such, we have revoked your certificate.

Did you even read your articles?

I hope you have read the guidelines from: [0]

> Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."

As for the certificate. Looks like private platforms doing private platform things.

[0] https://news.ycombinator.com/newsguidelines.html

Generically, yes. (So - ignoring details of Thawte's legal situation, etc.)

Sanctions, supporting Ukraine in various ways, etc. should be intelligently used tools, with an informed, competent, long-term strategy behind their use.

A lot of what's happening now feels more like "millions of 3-year-olds are really mad at Russia, so they each scream loudly, grab whatever thingie is close at hand, and bash really hard on Russia". Great for venting and follow-the-crowd virtue signaling. Probably far less useful for achieving reasonable strategic goals.

Strategic goal is collapse of Russian's economy. All these actions by Western companies contributing more than initial sanctions on oligarchs.

For most companies, early exit from Russia market is a good idea. They avoid tarnishing theirs reputation and Russia market is already half-dead. Even if Putin die today, these companies will not come back anytime soon. Russia just did 30 years reset.

> Strategic goal is collapse of Russian's economy.

Ah. Is that the (sole) strategic goal, or is that a tactical threat - which many people believe useful for "improving" the situation? And perhaps also a feels-good, looks-good bandwagon that lots of people want to jump on at the moment?

I'm thinking that most of the grown-up western leaders have a list of actual strategic goals, which looks more like this:

- No nuclear weapons used, especially not at scale, nor against my country.

- No nuclear weapons "lost" (to parties unknown) in a chaotic break-up of Russian state authority.

- No massive/widespread economic collapses, wars, famine, etc. resulting in very large (say, 1+ million) deaths. Nor (say) 10+ million refugees.

- No "large, ongoing" failed state situations.

- Russian's invasion of Ukraine clearly fails (short- or long-term) in the eyes of most Russian government & military leaders. Ditto most autocratic leaders in other nations, who might be tempted to stage invasions of their own.

- Ukraine and its people are freed from Russian occupations / attacks / threats, and have a good opportunity to rebuild...preferably not too far in the future.

- My, my party's, and my government's situations are improved (or at least not seriously degraded) by events related to Russia's invasion of Ukraine.

- Etc.

> Ah. Is that the (sole) strategic goal, or is that a tactical threat - which many people believe useful for "improving" the situation? And perhaps also a feels-good, looks-good bandwagon that lots of people want to jump on at the moment?

Economic collapse in Russia would result in: Putin losing power, Russia losing war or at least retreat from Ukraine. Most likely, multiple bigger civil war started in Russia Federation.

> I'm thinking that most of the grown-up western leaders have a list of actual strategic goals, which looks more like this: > - No nuclear weapons used, especially not at scale, nor against my country. > - No nuclear weapons "lost" (to parties unknown) in a chaotic break-up of Russian state authority.

That why West can only help Ukraine indirectly and fight suing economic sanctions.

> - No massive/widespread economic collapses, wars, famine, etc. resulting in very large (say, 1+ million) deaths. Nor (say) 10+ million refugees. > - No "large, ongoing" failed state situations.

Russia proven that they are European bandits and cannot be trusted. Nobody in EU will care about future of Russia.

> Russian's invasion of Ukraine clearly fails (short- or long-term) in the eyes of most Russian government & military leaders. Ditto most autocratic leaders in other nations, who might be tempted to stage invasions of their own.

You underestimate propaganda efforts. Most Russian still believe in military peace keeping action Donbas. Reality distortion is very strong there, sanctions are helping to get the message across.

> - Ukraine and its people are freed from Russian occupations / attacks / threats, and have a good opportunity to rebuild...preferably not too far in the future.

It is not so clear-cut. Once Belarus joins the war and French and German interest betray Eastern Europe, we can expect half of Ukraine lost and EU failing apart.

> - My, my party's, and my government's situations are improved (or at least not seriously degraded) by events related to Russia's invasion of Ukraine.

Most of Eastern Europe will benefit from the current situation.

It is hypocritical to claim that a client (the bank) should have protected speech at the expense of the provider.

A company choosing not to do business with someone seems to be a much strong free speech claim in my opinion. So if free speech is the hill you want to die on, you need to support Thawte.

> A company choosing not to do business with someone seems to be a much strong free speech claim in my opinion.

If my business chooses to not do business with "those people", you're okay? Or, does it depend on which "those people"?

Note that current US law says that businesses can't refuse to do business"those people" for certain definitions of "those people."

I believe that only applies to the hospitality business, doesn't it? A B2B company could refuse to do business with a company for any reason, including the skin color of that company's ceo. Furthermore, "those people" very much excludes nationality otherwise the sanctions against Iran would have been unconstitutional.

> I believe that only applies to the hospitality business, doesn't it?

Nope - while 42 U.S.C. §2000a was "public accommodations", it isn't the only law in this area.

> Furthermore, "those people" very much excludes nationality otherwise the sanctions against Iran would have been unconstitutional.

Nope on three levels.

The first one is that the groups protected by 42 USC (and the other laws) are "race, color, religion, or national origin and it's tough to see how that doesn't cover nationality.

The second one is that the laws for the first part aren't part of the constitution.

The third one is the regulation/law in question did NOT say anything about race. It said you can't do business with Iranian-country entities and had the "notwithstanding" boilerplate, creating an exemption to the other laws, an exemption limited to Iranian-country entities. That exemption did NOT cover Iranians without the country connection.

But the laws you are citing presupposes discriminatory intent. That is, the actions we are discussing must be motivated by a desire to discriminate. That intent cannot be established here as the claim that the motive for refusing to do business with Russian nationals in Russia and Russian companies is to put economic pressure on the Russian government.

The laws in question do not mention discriminatory intent.

You need to choose a play field and stick to it. If the argument is legal as you suggest then Thawte must be supported for compliance with the law. If your play field is "free speech" then thier right to make a statement must also be respected. In either case Thawte must be supported.

I’m against web censorship wholesale. Registrars and hosts and certificate authorities shouldn’t have revoked any existing contracts. But they would be within their rights to disallow renewal. And I hope to see people like “NameCheap CEO” who cancelled .RU domains on short notice without giving users enough time to transfer their domains-pulling the rug out from under them..sued for criminal contract breach.

breach of contract is not a crime and a country under harsh sanction will not have much standing in the civil/domestic courts of a country doing the sanctioning.

They can be sued civilly. and also be charged criminally for “denying of honest services”. The FBI has charged people with Honest Service Fraud who broke their contracts with Amazon recently in a high profile case and seized all their assets via civil forfeiture.

Cancelling someone’s domain or certificate earlier than the agreed upon expiry date sounds to me like a Dis-Honest Service.

You’re just further driving in the point that you don’t actually know what any of these words mean.

Honest services fraud has literally nothing to do with this. What’s next, RICO?

I don’t know if I agree with that second part, but yes, it’s a shame we ever crossed that line. Easily exercised censorship like this is a lot more damaging than, say, trying to ban a zine or newspaper; and will inevitably be used for the wrong purposes in the future.

Domains are expected to be set up to stay online without intervention for years(1-10 years + even) it’s not right to yank domains away in a couple weeks time span just to virtue signal your support for the anti-Russia agenda. Some of these domains are probably used for internal services for hospitals, medical equipment, domestic transit, electricity grid, telecommunications and more so when you fuck with domains it causes all sorts of problems for real people who had nothing to do with the invasion of Ukraine (which arguably Ukraine started, contrary to the msm message, Ukraine allegedly bombed schools and homes for 8 years in DPR) interview with civilians on Patrick Lancasters channel seem to support the claim that Ukraine was the aggressor.

I see. Again, totally agree that it is wrong to yank domains away, but not at all with your 'virtue signalling' and causing 'problems for real people' or 'anti-russian agenda' (Russia is destroying an entire country as we speak, there is no hidden agenda needed).

Invading and bombing a country causes "problems for real people".

Ukraine didn't invade Russia. Ukraine didn't start a conflict in the DPR either, Russia invaded Crimea while fuelling the separatists in Donbas. The world doesn't forget. I can't believe you eat up the idea that Ukraine is the aggressor. But also don't this is a place I'd like to discuss this topic. Farewell.

Hello, Russian propagandist. I am from another side of a conflict and deeply disagree with your allegations to look at what has been happening 8 years and not to look at whas happened earlier. But youl first sentence (about stay online w/o intervention) is exactly my message to HN crowd.

> sued for criminal contract breach.

I don’t think you even know what these words mean.

> this is an attack on the freedom of speech

Freedom of Speech is not universal in every country. People are jailed for speaking against their government in some countries.

The Terms of Service agreement, which nobody reads, probably has some legal mumbo jumbo in there that lets the provider terminate services on moral/ethical grounds as they see fit. So like if someone gets a cert for an illegal gambling website they can terminate it at will. They may also have clauses related to encryption levels and should there be sanctions on software encryption for certain countries they could be forced to revoke services.

Keep in mind that, while you're comparing this to nothing (the way things were a month ago), most of the rest of the world is comparing this to a war between Russia and multiple nuclear-armed nations.

Re-frame things around war as an alternative, like "The CA revoked our cert, but at least nobody is dropping bombs on us." The negatives will be easier to understand and accept.

I do. There's a difference between refusing to further conduct business and sabotaging existing business.

I don't think it matters whether this or anything else is an attack of "freedom of speech" in this war. These arguments might be right but it will take a lot of time to change someone's mind when they already decided Russia is the bad guy. This war moves much faster than this kind of precise dialog, which means faster strategies like "get as much hate towards the opponent as fast as possible" is going to be more fruitful. So things like propaganda, fake news, fake videos and photos, etc.

Artillery just isn't as effective as convincing people, and companies, to fight your side on the war.

Now, if you just want to debate what is right or wrong, then I agree, it's an attack of freedom of speech, especially if it was done without warning.

This was a stupid decision. Thawte is helping Russian government here and gives them a valid excuse to force switching Russian internet to national-issued certificates. It won't hurt Russian economy or Russian army.

Too much compared to what? Surely not to killing thousands of innocent people?

Whataboutism [1] is usually expected not from the party I am talking to.

[1] https://en.wikipedia.org/wiki/Whataboutism

It's a bit much in terms of... feigned malice.

What I mean by that is, it should be trivial for these organizations to both find an in-country vendor, but also rotate a certificate/keypair.

It's entirely punitive yet (I imagine) ineffective.

I understand halting business with a region given they probably aren't sure they'd be paid with the ever-growing sanctions

Sanction works over long term, so while this will definitely help bring down Putin's regime, it won't have any impact to this war which hopefully will end soon with some sort of treaty.

If it turns out like that, I hope that western countries learn the lesson next time and don't do such abrupt sanctions (because it won't work right away anyway). We have not heard much from inside Russia but they sure causes a lot of chaos that I think is unnecessary.

Some people even think it's OK to cut Internet, DNS and other critical services, you understand that emergency services and hospitals need them and that could cost human lives?

Compared to bombing super markets?

Noe

Reply on news.ycombinator.com