Apple, Google, and Mozilla are all taking action to block state surveillance of web users through their respective browsers…
The Kazakhstan government last month began intercepting all HTTPS internet traffic inside its borders. ZDNet explained how it was able to do so.
Local internet service providers (ISPs) have been instructed by the local government to force their respective users into installing a government-issued certificate on all devices, and in every browser.
The certificate, once installed, will allow local government agencies to decrypt users’ HTTPS traffic, look at its content, encrypt it again with their certificate, and send it to its destination.
ISPs were instructed to enforce this by checking for the presence of the root certificate and had to block traffic where it was missing, redirecting users to a webpage with installation instructions.
However, IT Pro reports that both Google and Mozilla have found a way to block this.
Google and Mozilla have both said they distrust this certificate and as such have introduced “technical solutions” that will prevent traffic from being intercepted. For Mozilla’s part, it has revoked the certificate using OneCRL, said to be a “non-bypassable block”.
Google has said it will also block the certificate the government required users to install and added it to the list of those blocked inside Chromium’s source code.
Reuters reports that Apple will be joining them.
Apple also said in a statement it would take similar measures to protect the users of its Safari browser.
The Kazakhstan government claimed that the measure was a ‘test’ of a system designed to protect its citizens from cyber threats. This nonsense has been dismissed by the browser companies, who responded by promising to block state surveillance using this approach.
Kazakhstan is not the only country that has attacked strong encryption. The UK’s NSA equivalent, GCHQ, recently proposed that Apple and others should be required to secretly add law enforcement agents to encrypted chats and calls — a call rejected by Apple, Google, and others.
The FBI, of course, wanted Apple to create a compromised version of iOS, with the Trump administration reportedly considering a ban on the use of end-to-end encryption. Apple has also opposed an Australian threat to do the same thing there.