Hacker News Reader

Comment by dathinab | Hacker News Reader

Hm,

- installing root certificate to access encrypted data (potentially of websites? including banking websites?)

- means bypassing security mechanism put in place to prevent people to access data send to a server (from a browser/app)

- means potentially bypassing DRM, too

=> isn't that illegal even if the user agrees to it? (at last in the US where some especially DRM related laws are strange)

View on HN

No that is absurd, this is standard practice for almost all enterprise setups, as a central component in the deep packet inspection solutions used in network security. So the chance of it being illegal as the user has agreed to participate is absurd. The only thing that would make it so would be to lie about the functionality and intrusiveness.

Remember that in the case of the Facebook VPN, they were asking teens to install it -- which means the teens involved (according to US law) are a protected class: under adult age. Under age folks can't legally agree to participate in anything.

Keep in mind, just because everyone does it doesn't mean squat for is it legal or not. It means it hasn't been tested in the legal system, such that a judgement has been passed regarding legality.

If somehow, the practice were found to be a key part of circumventing some large industry's means of controlling something, it could realistically end up becoming illegal once subject to legal scrutiny.

How would this bypass DRM?

I think the parent is implying that HTTPS encryption is a form of DRM. It's a reasonable question because AFAIK, the DMCA doesn't specifically call out DRM but rather any security/protection measures, so I can see how HTTPS would fall into that.

(However, upthread comments indicate that using certificates to see HTTPS traffic is a fairly common practice in enterprise setups)

Reply on news.ycombinator.com