Re: Nation State MITM CA's ?

2019-07-22 Thread jfb1776--- via dev-security-policy
On Monday, July 22, 2019 at 11:34:11 PM UTC-4, Matthew Hardeman wrote: > It is an interesting question. It essentially becomes a gamble on whether > they'll back down or just fork their own KazakhFox. But if they do push > this all the way with a national browser, then their people are even >

Re: Nation State MITM CA's ?

2019-07-22 Thread Matthew Hardeman via dev-security-policy
On Mon, Jul 22, 2019 at 9:20 PM Corey Bonnell via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > > I think the optimal solution in terms of user security is to create a > blacklist of known MITM CA public keys and simply prevent the installation > of certificates containing

Re: Nation State MITM CA's ?

2019-07-22 Thread jfb1776--- via dev-security-policy
On Monday, July 22, 2019 at 7:08:19 PM UTC-4, qm3...@gmail.com wrote: > The real issue is that they can quickly block update servers + instruct the > population to disable updates. Which means that banners won't make it > through, and the population will stay on today's versions permanently.

Re: Nation State MITM CA's ?

2019-07-22 Thread Corey Bonnell via dev-security-policy
On Thursday, July 18, 2019 at 3:42:00 PM UTC-4, Matthew Hardeman wrote: > Regarding indicators, I agree that it should be more apparent. Perhaps a > dedicated bar that occupies an entire edge-to-edge horizontal area. > > I would propose that it might have two distinct messages, as well: > > 1.

Re: Nation State MITM CA's ?

2019-07-22 Thread qm3ster--- via dev-security-policy
If Kazakhstan MITM certificates could be swiftly banned by all major browsers, it might roll back the requirement (just as it failed in 2016) by paralyzing work. It is also more likely to cause political action and people learning more about the impact of this "policy". Governments are very

Re: DarkMatter Concerns

2019-07-22 Thread Wayne Thayer via dev-security-policy
Benjamin, On behalf of Mozilla I'd like to acknowledge that your request has been received and is under review. - Wayne On Tue, Jul 16, 2019 at 12:14 PM Benjamin Gabriel via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > Message Body (6 of 6) APPEAL TO MOZILLA

Re: Nation State MITM CA's ?

2019-07-22 Thread h via dev-security-policy
Hello, i'm from Kazakhstan and asking you to ban this certificate. The only reason it's applied are political. The government will force everyone to apply it if it will not be banned. Right now in Kazakhstan thousands of people who a repressed for political views, even mothers are sitting in

Finance analogies for root stores (was: Re: DarkMatter Concerns)

2019-07-22 Thread Gijs Kruitbosch via dev-security-policy
(I'm splitting the topic because at this point, continuing to discuss the analogy doesn't have a direct bearing on the inclusion or otherwise of DM) Replies inline. On 16/07/2019 23:23, Matthew Hardeman wrote: I submit that I disagree somewhat with Gijs' suggestion that Mozilla acts in the