HN

Comments (121)

• Menu

  pibaker
  Sanctions on Iran are justified. But I worry this kind of action will just lead to the eventual rise of an alternative tech ecosystem in the long term, probably led by china and Russia. It will be bad for us, bad for people living under those regimes, but good for the regimes themselves because they will have the fullest control over their technology, without having to compromise with the West.Another example of why maximalist political hostility can be counterproductive. Leave an olive branch in sight, and you may work towards a mutually beneficial resolution, like the previous Iran nuclear deals. If push your opponent into a corner, then don't get upset when they jump over the wall into the wild where you can't catch them anymore. See also Chinese chips and AI.
• Menu

  lxgr
  Forcing their customers to install government-affiliated alternative CAs, in turn allowing the government to spy on its citizens more easily via mis-issued certs? Great, that'll show them.
• zzo38computer
  It doesn't load for me, but I have read the other comments.There is the problem of TLS and X.509 being used with centralized authorities like this, even though it is not inherent to TLS nor to X.509 (although they were designed to be used in this way). In some circumstances, you can get a copy of the certificate (which might be self-signed) from somewhere else and then check that it matches in this circumstances. In other circumstances there are other things that can be done (e.g. TOFU, which has a different set of problems, but also has advantages in a different set of circumstances). What the security requirements are will depend on the circumstances, which can also depend on the user's intentions; they should not have to depend on a centralized authority.(There is the issue that a single X.509 certificate cannot have multiple issuers, though. There is also the issue that X.509 certificates cannot contain unsigned extensions (they could be added after the signature, but an implementation might check for additional fields after the signature and reject a certificate that has any). Although an alternative schema can be made (I have done so), it would not work with the existing protocols.)
• Menu

  londons_explore
  This seems like the kind of thing that the USA will explicitly grant an exception to.It is clearly bad if the whole of Iran gets their own CA infrastructure which the NSA can't as easily spy on.
• Menu

  128471599
  It is a reminder to go back to cash, ATMs and machines where you can enter you transactions instead of using the Internet.There is no reason to give money to US middlemen for everything you do.The whole of the EU should do this, too. I stopped using Internet banking after my bank moved from SMS Tan to hardware Tan generator (one of which didn't work) to forced mobile app. No thanks.
• Menu

  gonzalohm
  I may speak from ignorance, but why do SSL certificates depend on centralized CA?If I'm an entity such as a bank, I should be able to sign my own certificate and provide the public keys to my clients which then can use it to both encrypt communications and to make sure you are talking with the entity you want to talk to. Am I missing anything?
• ValdikSS
  The same applies to Russian banks. Russian banks have switched to internal Ministry of Digital Development CA which is not trusted in common browsers.https://crt.sh/?id=22899279066 (Revoked: privilegeWithdrawn)
• cestith
  This seems like a bad idea.
• Menu

  badatnames
  Utterly moronic. We support the freedom of the Iranian people by forcing them to install a local government root CA in every browser. I mean at this rate they won't even have to buy their monitoring tech from China any more, just an old PC and a late 90s tarball of Squid
• jMyles
  It's bizarre that there isn't yet a total separation of certificate-and-state.
• yieldcrv
  petty
• dayyan
  Good.
• borschtplease
  One more technical challenge. The whole ssl infrastructure is incompatible with a state current planet moves forward to.
• zoobab
  It's not as if SSL critics warned about this ponzi pyramid, prone to censorship.
• Menu

  cyberax
  This is super-dumb. The same thing is happening with Russian banks.Their answer? They're now asking users to install root certs from the Russian ministry of communications. So it can now MITM all the encrypted traffic in Russia.
• Menu

  Daishiman
  So now that SSL certificates are being weaponized it now becomes a matter of national security for any country to have their own independent CA infra.Another win for the US.
• Menu

  fhejfnenjdcn
  [flagged]
• MadrasTh0rn
  Trump Vance Johnson Elon and Thiel are removing US institutions globally by forceTrump is intentionally playing into Chinese, Russian Noth Korean, Iranian handsThey must be impeached/removed regardless of intentNobody voted for this