Hacker News Reader

Comment by gruez | Hacker News Reader

Is this actually implemented? Do all browsers in india use weakened TLS or something?

I don't know if it is actually implemented, but note it could be either of the two endpoints that could cooperate to allow decryption - client (browser) or server.

It is possible that Google is not allowed to operate in India unless they transmit all the keys to the government somehow. If they are forced to share the private key used for Youtube's certificates, that would allow effective MITM, or entirely passive surveillance if a non-ephemeral key suite is used. Google could also be required to send them every ephemeral key.

There is no such implementation in India. The major censorship in internet here is SNI based HTTPS filtering.

Likely a governmental man-in-the-middle attack.

That's non-trivial to pull off without massive noise being generated by users. Even if you're able to somehow able to backdoor all domestic computers to install the government's root certificate, there's going to be a steady stream of complaints from foreigners coming in with their non-backdoored devices.

That means that either the government has a browser trusted root CA (which means they could spy on anyone in the world if they can MITM them), or they somehow force everyone in the country to install their trusted CAs.

Who says they can't, but weak encryption is definitely an easier lift.

Reply on news.ycombinator.com