Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Tech giants will block Kazakhstan’s web surveillance efforts again (engadget.com)
134 points by alexrustic on Dec 18, 2020 | hide | past | favorite | 113 comments


This discussion ( https://youtu.be/Q9s6YggbTk4?t=65 ) with Azerbaijan president summarizes really well Western democracy (or hypocrisy or lets invent a new name capitalocrisy). When it comes to China, everyone is impotent taking actions, because they rely on China too much, when it comes to country like Kazakhstan or any other smaller country, everyone seem to become powerful and create sanctions. Thank you UN for not being able to do your job!

UPD: it makes me sad so many Uighur people detained in camps, it is like living in 12th century, how this is happening in 21st century, beyond my understanding. People seem to forgive anything if they can get things little cheaper


> Thank you UN for not being able to do your job!

The UN is simply a forum for countries to meet and discuss international affairs. It is not a global governing body, and wields no power not authorized by its constituent member nations.


This is an important distinction and to understand why, it's helpful to read about its predecessor, the League of Nations which due to mismanagement failed spectacularly in its goals to prevent conflicts between nation states.


From their PR discourse, they don't seem like just a forum for countries to meet and talk.


In The Expanse (great sci-fi novels that just got a new TV season last week), the UN becomes the governing body of Earth after some climate-related disasters that individual countries could not or would not handle (I think).


What does it have to do with reality, though?


"People seem to forgive anything if they can get things little cheaper" - the problem is way deeper now. There are some products that does not have non-Chinese equivalents now (even more expensive), some products are not produced in China in their most expensive version (many smartphones). In addition China does majority of rare earth elements processing, needed for electronics. And the list goes on. So it is increasingly difficult to buy something 100% not produced in China.


Rare earths aren't the big deal everyone thinks they are. Rare earths are more or less evenly distributed across the planet but do not form ores so you can't mine them efficiently. There is nothing about it that only China can do, they just do it the cheapest, in part because they do it an a more polluting fashion.

Yes there would be massive supply socks if we lost access to the Chinese market but they would stabilize (at a higher price) in time. This is different than something like a modern CPU which China cannot produce at any price.


Consider what happens if China takes Taiwan and TSMC.


WW3 and we live in huts. The US would implode before giving up military dominance in asia pacific.


There have been rumors for years that Taiwan has arrangements to quickly destroy critical TSMC technology/equipment in the event of a mainland invasion.

No doubt these whispers are spread deliberately to serve as a disincentive for attack, just like the ghost stories about automated retaliation ("Dead Hand," etc) during the Cold War / MAD era. In this case: "If you attempt to do X in order to acquire Y, a robotic, dispationate, automatic force will see to it that Y is destroyed before you can get to it. Therefore acquisition of Y is no longer a good incentive for X."


Yeah, but taking down TSMC will hit the US more than China, I suppose.


Sure, but China can destroy TSMC regardless (it's cost-prohibitive to harden something the size of a semiconductor fab against even conventional, dumped-out-the-back-of-a-aircraft bombing). The point of a scuttling system is not to prevent it from being destroyed, but to prevent the enemy from gaining any benefit from capturing it.


Capitalism's whole ideological point is about producing things as cheaply and efficiently as possible.

I find it amusing that everyone suddenly hates capitalism now that the Chinese are good at it.


Most people don't hate pure capitalism. It's just that China is doing every single thing they can whether it's legal, grey area, or illegal... to get ahead. And their aims aren't just to be efficient. They are to use that efficiency to achieve their authoritarian government's goals.

So when you look at all of that together, it really is something that the "free world" should be worried about.

Most of the tech that China profits off of was developed in the west. Efficiency needs discovery for progress.


Just like when America flaunted copyright and patent law 200 years ago.


While I'm on the same page with you re China, it doesn't mean that actions should not be taken where they could be afforded by political realities.

China and Russia gain strength in network effects of growing illiberal alliances, and taking the smaller fish helps.


I'm afraid the only thing such one-sided actions will do is to throw them in the arms of Russia and China.


It's quite an assumption they aren't there.


[flagged]


I was Soviet and Belarusian citizen, I don't need your emigree wife opinion on this really.


Do you have anything additive to the discussion?


Anecdotes are evidence now.


I didn't share any anecdotes.


I think he was not referring to you, but to your parent poster.


Is the Russian wife the new Canadian girlfriend?


Well except a small company selling servers and security for data analysis suffered quite a big push from what seem to be a Serbo-Russian group, using one of our client VPN in belgrade and a lot of social engineering (investing 6 month and a fake identity). Incidentally it looked a lot like ATP28 attacks, and probably the data wouldn't even be worth that much, making the operation unprofitable even if it were more successfull than that it was.

When Fancy Bear will stop putting their greasy fingers everywhere for no reason, maybe i will stop the "bullshit rhetoric parroted by the media and citizens who don't know much about the country". Until then, sorry but to me tehy will be an enemy.

I also happen to have a friend who live in Kiev since 2012 and is now in the "priate security" business . "lot of poverty" is quite nicely put. When a state (city in this case, but well, no one is fooled) is hiring mercenaries from private companies to keep people in order, yeah, seems like a great country.

Volgograd, St-petersbourg and Moscow are fine, sure, but border cities?


Eh, since what Snowden exposed seems to have been "normal intelligence activities" it seems weird to make a big deal about the Russians doing the same sort of things.

Stick to complaining about the murders.


Kiev is in Ukraine, and is currently a stronghold of a very pro-US president. Who is hiring those security goons again?

So without realizing it, you are actually agreeing with something Russians have been saying for a while now: that the two sides of the standoff in Ukraine are not "freedom fighters" and "evil Russian henchmen" but rather two oligarch clans.


People are generally the same all over but that doesn't mean that the actions of their state aren't fundamentally incompatible with the actions of other states.

I the average Russian (or eastern european in general) has more common ground with the average American than the average Frenchman or Italian does. That doesn't mean we can get along though.


Who's using all that novichok then?


I read a theory that powerful groups carry out these attacks to gain favor with Putin etc. There is never a direct order from above. It's just done, and if it's done successfully the intelligence eventually finds out, then Putin finds out, and they expect some favor down the road.


Someone wanting to frame the Russians, or the Russians.


Sure it is: after the cold war there was some debate but in the end then NATO decided they preferred Russia as an enemy rather than as an ally.

Russia got the message and are now dutifully playing its role.


From the German perspective there is a country east with loads and loads of nukes and on the west a paper ally

Around 2000 they wanted to become part of Nato, but this all changed with the Iraq war. The Afghanistan, Georgia, Ukraine, Syria wars later followed further dividing the two powers.

Besides states don’t have friends, only threats. Nothing to do with girlfriends, friends or people. Just the nature of states


No, after the Cold War, countries that had been under the control of the USSR decided they didn't want Russian tanks rolling into their capitals again.

Those countries which joined NATO ended up being vindicated when they saw what happened to Georgia and Ukraine.


Right, and Turkey is a nice and upstandnding world citizen that hasn't done the exact same thing and in addition funded IS.


I support this sentiment (even though I hate Putin). Anytime cyber attack, breach or violation happens inside American companies, some how Russian hackers are involved. Is this really true? How come election is manipulated by Russian when Trump elected, but not when Biden elected? Why Twitter is not considered as an enemy of American people when they are censoring content as they wish?


The idea that anyone seriously alleged the election was materially hacked in 2016 is dangerous newthink. The Russians (using wikileaks as their mouthpiece) strategically released information they had gained illegally to damage the Clinton campaign, but they never hacked anything directly related to the election itself.

This was widely confirmed by both US 3-letter agencies (generally dominated by republicans) and the private sector at the time.


> [no one alleges] the election was materially hacked in 2016

While the voting machines themselves may have avoided foreign interference, other infrastructure around the voting process may well have been compromised. For example consider this article from last year[0]:

> Florida incurred an election-related security breach in 2016 that could have resulted in voter data being altered, Sen. Marco Rubio said Friday. ... Hackers were “in a position” to change voter roll data but apparently did not, Mr. Rubio told The New York Times.

If we can take Mr. Rubio's word for it, the Russian hackers went to all that trouble and then decided not to act to change the result of the election, but perhaps they found that the voter rolls had already been subject to so much partisan tampering that any more manipulation would risk backfiring.

[0] https://www.washingtontimes.com/news/2019/apr/27/marco-rubio...


That's the problem with voting machines. It's not possible to understand what is happening, for everyone.


Paper is the only way, I feel. Any electronic solution ultimately relies on relying on some kind of black box


Putin supports Trump as fellow illiberal soul, and is very much opposed to pro-democracy Biden. This is why he is helping Trump and does not help Biden.

What Twitter should be considered is irrelevant to the fact that Russia assumes itself at war with United States.


looks at the 1996 Russian election (as well as the other elections that the US has hijacked)

I do not know if "Russia assumes itself at war with United States" or if the US assumes itself at war with literally everyone else (they were even caught spying on their own european "allies").


"War is merely the continuation of politics with other means."[1]

1: https://en.wikipedia.org/wiki/Carl_von_Clausewitz


The outcome of 1996 elections is the result of Russia's own political process, which can sometimes be very ugly entirely independently of anyone else. Although it's clear who America rooted for then they had very little if any influence on the ground.

Either way, Putin is Yeltsin's creature. He has no reason to be disappointed with 1996 election outcome.


You need enemies to control the masses. Otherwise people will be too preoccupied with trying to figure out why their life is so hard and government isn’t doing anything to help them. In his desperate attempts to keep the power, Macron is trying to make Muslims some kind of villains. Just pathetic...


Russia has chosen to be our enemy. This comes down to Putin, and has two causes.

First, geopolitical. Putin feels threatened by NATO. I suspect he remembers World War II, how the Germans launched an invasion from the middle of Poland and nearly broke the USSR. He fears NATO being nearer than that. But he can't seem to stop meddling in places like the Ukraine and Georgia, so many of the former Warsaw Pact (and even USSR) countries flee to NATO for protection. This puts NATO closer to him, so he fears more and wants to meddle more to make the remaining non-NATO countries more closely tied to Russia. And so it goes.

Second, political legitimacy. Putin hates real democracy, anywhere. I suspect that the issue is that parts of his population resent his sham democracy (the "vertical of power") and want a real one (and a free, honest press). Putin therefore wants to destroy or at least discredit democracy. That's the point of his disinformation campaign. It's not just to get Trump elected (though he's in favor of people who are friendly to him). Mainly he wants US democracy to look bad rather than like a shining example to the Russian people.


The smaller fish will turn to China to provide them with the technology the West denies them.

Every year the old world order crumbles a little more.


>it is like living in 12th century, how this is happening in 21st century

because human nature hasn't appreciably changed between the 12th century and today


This hits so hard. All the technological advances, yet how much progress have we _actually_ made?


A former British colleague of mine summarized this well:

"You now have a better standard of living and can afford a car and a bigger, warmer place to live to live than one/two hundred years ago, and yet you're still a servant, except that instead of a serving a crown that can the skin off your back, you serve massive conglomerates that can take the skin off your back."


If anything, technological progress could mask moral or social decay. Survival bias is a thing of course, but reading literature and philosophy from ancient cultures gives me a general sense that they put much more effort than we do into developing virtue and human excellence, or what the Greeks called arete


The world only has become more complicated. It's far more difficult to change things now than it was in medieval times.


I am surprised (not really...) this is any news to anybody.

It has always been true that the strong one was able to impose on a weaker one and that strong ones had to tolerate themselves up to a point.

It is true in private life as well as in foreign relations.


What's amazing is how true this is culturally and for discourse as well, for me. With the amount of activism now happening in the western world, it's amazing that it's not against China or other abusers of human rights. No, it's usually against your own country which is multiples better to live in than somewhere like China from an oppression point of view, yet it's taken decades to even get it into the conversation. It's literally taken concentration camps of muslims for even a mild interest to take place in big media organisations about whether China is a decent place or not.

And I'm not saying they should cover it. They're free to do what they want. But claiming to be activists against tyranny and oppression while ignoring china is very hypocritical.

Where are the calls for boycotts? Where are the kneeling sportsman? Where are the protests?


So I should not fix a leak in my roof because Steve’s house down the street is flooded and I should be happy that my bedroom is still dry?

So, succinctly:

1) Ultimately, what happens in another country is that country’s problem. Sometimes we ought to intervene, but the bar needs to be very high. Intervention most of the time leads to outcomes ranging from bad to catastrophic.

2) I am entitled to participate in how my country is run, and I owe to future generations to help improve it as much as I reasonably can.

I’ll let you piece 1 and 2 together.


Don't use 'it is worse over there' as a counterargument against someone who fights (rightfully or not) for things to be better 'here'.


Of course if you've thought this far you've determined the answers - the media and their activists are politically motivated. Presenting as activists against tyranny and oppression is part of a strategy, they want to attract and exploit people who hold those values. These strategists and politicians think in terms of achieving outcomes and are more cynical than most can imagine.


While I don't disagree with the idea that larger and more powerful states get cut more slack, this is an instance of fraud. Some entity is misrepresenting themselves as Facebook and the rest. This is a technical reaction to a straightforward error. Failure to react would put the entire TLS identity system at risk.


Friendly reminder that in the 12th century central governments didn't have enough power for these kinds of shenanigans and the best they could do was get a crusade going which was massively taxing on the population and not at all sustainable.


Correct, they couldn't keep millions of people in camps, but the leading 13th century power just went ahead and killed millions of people instead (at a time when world population was much lower).


> This discussion ( https://youtu.be/Q9s6YggbTk4?t=65 ) with Azerbaijan president summarizes really well Western democracy (or hypocrisy or lets invent a new name capitalocrisy

Since when are Google, Microsoft, Apple, Mozilla examples of "Western democracy" ( as if that is some monolithic entity..)? They are private companies, and can do as they like within the legal frameworks they operate in.

Of course everyone is impotent taking actions against big, powerful, rich, heavily armed, strategically important countries. Who can say anything to China, and even more mundane - Saudi Arabia, Turkey, ffs, USA, UK, France, etc. and try to impose it? War is out of the question ( your population would probably be against it, and attacking nuclear powers isn't really a good idea; for the non-nuclear powers, they're still heavily armed, so you're still looking at a costly military affair), and economic sanctions will probably be more crippling for your country than them, and will probably strengthen their dictators' position ( country X is our enemy and doesn't want us to succeed!).

The UN isn't the world police, and can't be. It's based on all countries participating together, and complying to rules set together. The consensus can't work against countries with veto powers ( but they wouldn't have joined otherwise), or against dictators that don't care or can find a workaround/allies that will support them anyways, thus making UN decisions impossible or inapplicable.

What do you think can any world leader do? Would you support your country, whichever it is, going to nuclear war against China to free the Uighurs and kill millions in the process? Would your fellow co-citizens when that means a crash of the economy, massive job loses, serious lack of all sorts of products, not to mention all the dead and maimed soldiers? If you think a trade war might work, it probably won't, and would still heavily impact the world's economy, with countries with debts to China and Chinese-operated companies/infrastructure being caught in the crossfire.

Be realistic. The only thing that can stop China is China itself.


> The only thing that can stop China is China itself.

Why this sentiment is not applied to Russia then? instead of making sanctions, countries can say, only thing that can stop Russia is Russia itself, same should have been applied to war in Syria, Afghanistan, Iraq, Vietnam and any other war happened in 20th century.

If you turn deaf to world, world will make you deaf.

I think economy almost survived huge pandemic, this proves taking radical actions is possible, yes it will impact lots of people, but end result could be best for humanity. I know people individually can not boycott Chinese products, because more people, more difficult to come to consensus, there will be excuses anyway. But, western government can come to consensus and decide not to buy anything, literally anything from China, this will hurt really hard everyone (people living in China, in big economies and everyone else). If this action will take place, then history will remember it and anyone who wants to work against human rights will know there will be huge hurting actions.


Sanctioning Russia has indeed sent Putin into an alliance with China. Those who don't want to play according to Western rules now have an alternative.

I think you underestimate China's contribution to the global economy and overestimate the will of the average Western citizen to suffer for human rights in a faraway country.


“Why this sentiment is not applied to Russia then?”

Because China is literally 10x the GDP of Russia. The West, and particularly the USA, is willing to give up what it gets from Russia because it would have little impact. The same can not be said about China.


But this pretty much proves the GP's point - that there are no actual morals or higher principles to who can get away with human rights violations and who gets sanctioned, it's simply about power.


> Be realistic. The only thing that can stop China is China itself.

What if their leaders started dying mysteriously until the country changed? No need for war.


> when it comes to country like Kazakhstan or any other smaller country, everyone seem to become powerful and create sanctions.

It's because Kazakhstan tries to man-in-the-middle attack all their citizens by making them install a government-issued root certificate, which is easy to defend against. (Just don't trust the certificate.) If they used an IP-based blocklist to filter all traffic (like China), that would be much harder to counter.

As for sanctions, I haven't seen any proposed against Kazakhstan over their human-rights record (including suppression of their own Uyghur minority).


> When it comes to China, everyone is impotent taking actions, because they rely on China too much

Because they are a major world power. What has anyone done to stop our invasions of iraq, afghanistan, etc? What has anyone done about Britain/France and their invasion of libya? What has anyone done about Russian annexation of crimea or the EU's "annexation" of ukraine? Has nothing to do with trade. Even if we stopped trading with china, we aren't going to attack china.

> Thank you UN for not being able to do your job!

The UN was created by the US, Britain, France, Russia/Soviet Union and China primarily to prevent wars between US, Britain, France, Russia/Soviet Union and China. They are the 5 permanent security council members with veto powers for a reason. So the UN has actually done its job well if you understand why the UN exists.

> UPD: it makes me sad so many Uighur people detained in camps

What people? You mean the terrorists/separatists? By "camps", you mean prisons/detention centers? Why aren't you crying over the libyans, syrians, kurds, etc?

> People seem to forgive anything if they can get things little cheaper

And everyone is getting a bit tired of the "uighur" propaganda. The top comments here are literally propaganda. What happened to your lies of genocide? Funny how you people talked about "genocide" and now are beaten down to "camps". What happened to genocide? Can't really pull of that lie anymore when the uighur population has increased 10X?

The chinese had detention centers for uighur terrorists/separatists for nearly 20 years now. Why are you all off a sudden "upset"? And stop hijacking threads that have nothing to do with china or uighurs to peddle your disinformation.


> The chinese had detention centers for uighur terrorists/separatists for nearly 20 years now.

China has also been using forced labor as part of regular punishment for less dangerous crimes like prostitution and drug use for decades https://en.wikipedia.org/wiki/Laogai which does make it look like political calculation that the current campaign to get companies to stop using forced labor is limited to Xinjiang instead of all of China, or the rest of the world, for that matter.

That doesn't mean that declaring everyone arrested a terrorist or separatist is any less propagandistic. There are plenty of perverse incentives to arrest people on trumped-up charges. Here's an article about the war on drugs in Yunnan: https://madeinchinajournal.com/2019/10/25/punish-and-cure%ef... illustrating how the police are incentivized to polish their arrest quota, of drug addicts in that case. It's unlikely that police in Xinjiang are acting with any more precision and accountability in the war on terror than their colleagues in Yunnan in the war on drugs.

> What happened to your lies of genocide?

It's also possible that the person you're replying to never believed in the "genocide" story, but nonetheless thinks that arresting thousands of people based on mere suspicion of terrorism is unjust and unnecessary. Not everyone sorts neatly into one of two factions.


> It's also possible that the person you're replying to never believed in the "genocide" story

Of course not. Propagandists know the propaganda they are spreading is false. Especially something as absurd as uigher genocide.

> but nonetheless thinks that arresting thousands of people based on mere suspicion of terrorism is unjust and unnecessary.

No. I doubt that.

> Not everyone sorts neatly into one of two factions.

Propagandists do... I love the role you are trying to play. It's a bit obvious, but a welcomed distraction.


> Propagandists know the propaganda they are spreading is false.

If everyone who says something untrue is a propagandist who doesn't believe their own lies, then there's little reason to debate, since then everyone would know the truth, even if some may deny it. I rather think that most people who spread propaganda do so unwittingly, because they earnestly believe that they have some information that is both true and important.

> I love the role you are trying to play. It's a bit obvious, but a welcomed distraction.

I have some trouble noticing how I am perceived by others, so could you tell me what that role is? Am I the incorrigible idiot who thinks there are no bad people, only good people making mistakes? The mediocre mediator who believes the truth is always found in the middle between two extremes? The compulsive contrarian who'll find a reason to disagree with anyone? The perfidious propagandist who serves up a watered-down version of the same lie if the previous one didn't catch on? The annoying alliterator for whom words are toys and the truth a bendy reed?


[flagged]


> Send a few ICBMs

Just out of curiosity, did that work with Iraq, Lybia etc. I really do want to know.


I mean the whole idea is preposterous. I really can't tell if the parent is being serious. "Yes let's murder hundreds of thousands (potentially millions) of people. That'll surely make the survivors sympathetic to our cause".


Maybe they are merely suggesting that the US bribe some officials by giving them ICBMs? Not sure how that's supposed to work either...


The parent comment is flagged but I think the answer is yes, that those offenses did serve the near term national interest of the US at those times.


> it is like living in 12th century

It’s more like 21st century where people of color and members of marginalized communities are forced to live in ghettos. No financial stability, prejudice, and violence.


> where people of color and members of marginalized communities are forced to live in ghettos.

You mean poor people.


Everyone is equally impotent when it comes to china as is with the us. What is happening to blacks, police brutality, corruption, war crimes and so on would have been condemned by the un and the “international community” a long time ago and perhaps sanctions would have been imposed. But as with China this cant happen because the us has money and nukes.

And sadly, most americans take the worlds inaction as a sign of those issues not being that bad.


Hmm so why Kazakhstan and not China? Is it because the Kazakh market isn't important to their bottom line? I'd love to know how big a market has to be before they play ball with the oppressors.


It comes down to identifying dependencies and justifying the necessity of partnering with a regime with relatively diverse/relaxed human right policies.

My PR background tells me that this is a weighed decision - Condemning Kazakhstan will yield a considerable amount of media attention with very little opportunity cost. Whereas doing the same to China would get you fired as a PR professional.


>Is it because the Kazakh market isn't important to their bottom line?

Kazakhstan population 15 million, GDP 179.3 billion USD

China population 1393 million, GDP 14,342.90 billion USD

You might be onto something here.


Because there has not been any proof that China has been using any CA certificates to spy on people. When there were some dubious dealings at StartCom, action was taken as well.

If the Kazakh government implements the same control methods China has implemented, big tech companies will use the same excuses to remain at a distance. Local competitors will recreate any service that's not available on the Kazakhnet in the same way China has a local competitor for every type of social media or any app in general.


Because this is an anti-Russia move.


why Kazakhstan and not US


Why not the us too? I hear the nsa and fbi are doing a lot of illegal snooping and the police are torturing and killing minorities. I am not defending china, but all countries exploiting their citizens should be punished.


Only the big boys that get away with stuff like this.

Why not distribute a modified Firefox browser if you want to spy on your citizens? Should be fairly doable and doesn't need any Big Tech blessing.


Why would the citizens install it?


Because it comes preinstalled on everything sold in the country, you need to use it to access websites, and if you’re caught trying to bypass it there are penalties. You can’t “one weird trick” your way out of a repressive government.


Why would the citizens install the malicious certificate as it is? Because without it, they won't be able to browse the Internet


Do some handshake to the ISP from the browser or no internet for you. Make walled garden browser use cheaper like Zuckerberg does in Africa.

To be clear I am not advocating this.


That could be circumvented with a browser extension though.


in a modified browser? perhaps that extension is not able to be installed..



I've always found the size and obscurity of the pre installed root certificates list to be suspicious as any one of them can eavesdrop on any TLS communication.

I've always assumed that every nation has atleast one under their control to allow MITMing .


Anyone have another link for this? Current link redirects to https://guce.advertising.com/collectIdentifiers?sessionId=3_..., which is blocked at the DNS level on my network.



Does "they are a private company, they can do whatever they want" also apply to international politics?


btw how would they handle android apps etc which pins the certs?


I've worked for a company that specializes in blocking certain websites for certain people (porn blocking stuff). The company used MitM-attacks with a custom TLS certificate, just like the Kazakh government uses.

There's two ways to deal with certificate pinning. The first is to apply SNI sniffing (which will work until eSNI makes its way into more software) to determine that a certain domain is related to a certain, permissible service and bypass the decryption filter. This can be coupled with certificate validation to prevent domain fronting.

The second method requires rooting the device and using a tool like Frida to automatically disable any validation checks. On Android and iOS there are special APIs to do certificate pinning but not all apps leverage them.

Many apps will also work fine if you install the CA to the system partition instead of using the user store. App developers often don't know that certificate authorities are even a thing that can be managed by the user, let alone that the set can be extended, so most apps use the default setting, which has been to only trust system certificates. This was changed back during the release of Android 7, before that time all apps defaulted to trusting user-installed certificates.

The third option, which any company or government can take to get off easily, is to blame the app for trying to break your righteous surveillance and to leave the apps broken. Netflix can be made to work any time, all they need to do is release a patch that disables certificate pinning, so if the government can get the public to blame the apps, they get off scot free.

The first method works transparently to applications. The second requires physical access to the device and rooting the OS, which can be impossible. The third only works if the people you're surveilling take your side. I'd guess they pick option 1 or 3.


In security, certificate pinning is a good practice because it defends against, who guessed it, MITM.


Obviously. Few apps (outside the very big ones) actually do it though, and with root access any attempt at cert pinning is trivially bypassed of course.

Annoyingly, many telemetry providers seem to have implemented cert pinning because I can no longer inspect the traffic flowing to telemetry endpoints from my phone without rooting it. That's quite a pain in my opinion. I'm fine with being unable to see my bank's traffic, but I want to know why the MS launcher is uploading kilobytes of information every minute instead of just deleting it entirely. That's the downside of being a power user, of course; the features I want cannot be made available to the general public in good faith because bad governments and companies will abuse them.


I was wondering the same. Presumably Netflix would only work through the browser, not through the apps available for various platforms.


honest question, if the concern that a Kazakhstan government issued root CA could be used for backdoor for citizen's data, should I be concerned about whoever issued the root ca on my personal device? which are mostly US companies.


Yes, you should. As soon as there's proof some of them are compromised.


Kazakhian chief scientist Dr. Yamak will not like this. Especially now that Jonny the monkey (greatest national movie star http://jonnythemonkey.com/) disappeared they must try to shut down access to international online movie theater to prevent rise of foreign influence!


I support the kazakhstans actions. They come out in the clear and let their people know what they are doing. They don't lie while under oath to the people supposed to be holding them accountable. They aren't hording vulnerabilities, spending millions trying to break crypto implementations, and undermining the trust of their citizens.

They are straight up and honest. I wish more governments were like that.


Why? What is their government so afraid of to inspect all country's traffic?


[flagged]


wow. HN has gone downhill.


A new account with 2 comments on an very anonymous site requiring absolutely nothing personal to sign up shows HN has gone downhill?

anonymous sign ups have their advantages, as well as disadvantages.


Cultural Learnings of Big Tech for Make Benefit Glorious Nation of Kazakhstan


I don't see how Kazakhstan could've outbid the abusive oppressors


This is just rich. I don’t know what’s funnier: Kazakhstan’s overt, bush league attempt at surveillance using certificates, or the virtue signaling by the Big N’s who surveil us daily at the behest of Uncle Sam.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: