For everyone's reference, here is a link to the old thread: https://groups.google.com/d/msg/mozilla.dev.security.policy/wnuKAhACo3E/ujxPTWTlCQAJ
To be clear, the Kazakhstan government CA's root inclusion request referenced in that thread was denied: https://bugzilla.mozilla.org/show_bug.cgi?id=1232689#c11 However, a bug has been filed proposing to blocklist the current, untrusted CA certificate being used by the Kazakhstan government: https://bugzilla.mozilla.org/show_bug.cgi?id=1567114 In reading through the old thread, consensus seemed to be that blocklisting this CA certificate isn't a good idea. The old thread mentions the idea of adding a visual indicator to Firefox when a root that is not included in our default root store is being used. Somewhat coincidentally, this was added in Firefox 68: https://bugzilla.mozilla.org/show_bug.cgi?id=1549605 Finally, I'll point out that Firefox implements public key pinning via a preloaded list of sites, so the reported MITM will fail for those: https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning#Implementation_status - Wayne On Thu, Jul 18, 2019 at 8:55 AM starosekpd--- via dev-security-policy < [email protected]> wrote: > Sorry for bumping this old thread, but the Government of Kazakhstan has > already started to use the certificate for MITM. Some information in news > (on Russian): > > https://tengrinews.kz/internet/spetsialnyiy-sertifikat-poprosili-ustanovit-smartfonyi-374216/ > > https://tengrinews.kz/internet/problemyi-dostupom-internetu-mogut-poyavitsya-astanchan-374068/ > > https://www.nur.kz/1805169-problemy-s-dostupom-k-internetu-mogut-poavitsa-u-zitelej-nur-sultana.html > > Our internet providers via SMS inform us about the need to install this > certificate that can be downloaded from their websites: > http://qca.kz > https://www.kcell.kz/ru/product/3585/658 > > https://www.beeline.kz/almatinskaya-obl/about/press-center/press/news/details/sertifikat-bezopasnosti/ > > Just to note, this certificate is not the same with the one that was > published in this thread. Current one is issued by "Qaznet Trust > Network"/"Security Certificate". > > At the moment, providers started to use the certificate in the capital of > Kazakhstan - Nur-Sultan (ex. Astana). > > Did Mozilla have any way to prevent such attacks? > > -- > Thanks, > Pavel > _______________________________________________ > dev-security-policy mailing list > [email protected] > https://lists.mozilla.org/listinfo/dev-security-policy > _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
