1. 37
  1.  

  2. 13

    This is not a good precedent.

    1. 12

      OK, several reasons why this is not as scary as you might think:

      • USA (and many other countries) can already do this to the entire world.
      • Metadata about what sites you visit over HTTPS is already sent in the clear because of SNI and DNS (and incidentally, IP as well).
      • The situation is actually about as bad as it can be already, where multiple countries, not just the United States and Kazakhstan, can MITM Kazakhstani traffic (and other traffic).
      • Similar to the Dell root debacle, at some point some hacker will get their hands on a CA’s cert, whether it be VeriSign or Kazakhstan Central, and they will also have the power to MITM all your HTTPS traffic. If they are generous like Dell, they’ll give that power to everyone else as well.

      So, people really shouldn’t be all that worried about this situation (as opposed to being worried about our current one) simply because it’s nothing new. We’re already f*cked.

      1. 5

        They basically get the same ability as the NSA/GHCQ, but don’t need programs like PRISM to get to the data. [/cynicism]

        1. 3

          The link gives 404 and I couldn’t find anything clear about this on the page, so I dug up an Archive link

          http://web.archive.org/web/20151202203337/http://telecom.kz/en/news/view/18729