Hacker News Reader

https://atlas.ripe.net/frames/measurements/28334941/#!probes is showing you that, for a v4 connection to twitter.com, probe 6745 is getting back a TLS cert which does not match the cert provided to the majority of other probes.

If you expand the row you can see the nation state MitM: notice the O=ISCA, C=KZ.

So what’s the point? If you don’t trust the certificate you won’t be able to browse the internet at all.

I think it's either consciously let users to browse the Web over HTTPS and see green locks everywhere while effectively being MITM’d (undermining the point of encrypted connection), or ban each compromised certificate (making the Web difficult or impossible to access for folks in this situation).

The remaining alternative is not defaulting to HTTPS for cases like non-sensitive static sites, which would be an unpopular proposition with some objective downsides.

> So what’s the point? If you don’t trust the certificate you won’t be able to browse the internet at all.

If all the major browser vendors do this it makes Kazakhstan's position quite difficult.

Unless they decide to cat-and-mouse: issue a new one.

Every time they issue a new certificate, they need to get every single user to install it, whereas it should only take a moment for the browser vendors to block it. I would think it's pretty clear who has the upper hand there.

They would be better off releasing some fork of Chromium—which is, unfortunately, also a thing they can presumably do...

The browser vendors could stop trusting O=ISCA, C=KZ entirely.

The point is that if browsers block the cert it will make the MITM impossible without them releasing thieir own browser. It will be much more clear for normal uaers that the custom browser can intercept internet traffic than that "security certificate". Also good luck getting that browser into the AppStore and PlayStore or making users install the apk.

So this certificate will be added to "not trusted" of all the certificate storages (Windows, Firefox, Chrome, Java, and all others) ... riiight?

I expect it to be added to Chrome and Firefox blacklists. Not sure about others. I don't think that Java even have a concept of CA blacklist.

Reply on news.ycombinator.com