Hacker News Reader

Comment by vbezhenar | Hacker News Reader

When Kazakhstan tried to MITM with untrusted certificate, Google quickly blacklisted this certificate. Hopefully it'll do the same for any other government or company, so nobody would even think of it.

View on HN

The EU is currently proposing to mandate the inclusion of roots that have been government approved, and to limit browsers from removing/distrusting them without notice/approval.

https://www.eff.org/deeplinks/2022/12/eidas-20-sets-dangerou...

They could do that because Kazakhstan doesn’t make them much, if any, money. This amounted to cheap good will marketing.

If this were the EU or US, and Google risked losing access to that market, they would comply. Way too much money on the table.

*China has entered the chat

Google wouldn't comply before first lobbying heavily against it both in government and among their users. The proposed laws would quickly become a major topic of public discourse.

As with other laws ther lobbying position is pretty weak in the EU. They (and other US based big tech) lost the last few rounds of the regulation / lobby game.

They don't employ (many) people here, don't pay a lot of taxes and generally don't do much cooperating on their own.

They can offer literal briefcases of money to politicians but, in General, that is not the way the EU works.

Remember how that went for net neutrality? It’s apparently very easy to get many members of the public to argue against their own interests these days.

Major in our circle probably, but just like most laws we decried as terrible, about half the time they will pass. Like DMCA, Bill C-11, etc. And Google will support anything that helps it maintain its dominance in the ad market in the parts of the world where they make their money.

Or China. https://youtu.be/hhMAt3BluAU

> Hopefully it'll do the same for any other government or company, so nobody would even think of it.

The security services in my country, Romania (an EU and NATO member), are already doing that, or something similar to that. For example trying to access https://sputnikglobe.com/ sort of times out, either way, it doesn't work.

Looks normal to me: https://www.ssllabs.com/ssltest/analyze.html?d=sputnikglobe....

Can you clarify what you mean?

That website (and others like it) is blocked in my country based on a political decision. Interesting that the guys from the Romanian secret services aren’t doing that by messing with security certificates, but the website is blocked nonetheless.

Sounds like they're sniffing the SNI header and blocking based on its value. Completely unrelated to the Kazakhstan root CA fiasco.

Reply on news.ycombinator.com