Subject: [Add] FYI: regarding HTTPS interception

From: Rob Sayre <[email-masked]>
Date: Wed, 21 Aug 2019 12:43:55 -0700

Hi,

I thought readers of this list might find this blog post relevant:

"When making secure connections, Chrome trusts certificates that have been
locally installed on a user's computer or mobile device. This allows users
to run tools to inspect and debug connections during website development,
or for corporate environments to intercept and monitor internal traffic. It
is not appropriate for this mechanism to be used to intercept traffic on
the public internet."

<
https://security.googleblog.com/2019/08/protecting-chrome-users-in-kazakhstan.html

thanks,
Rob

---

From: Patrick Mevzek <[email-masked]>
Date: Wed, 21 Aug 2019 15:25:57 -0500

On 2019-08-21 14:43 -0500, Rob Sayre <[email-masked]> wrote:
> "When making secure connections, Chrome trusts certificates that have 
> been locally installed on a user's computer or mobile device. This 
> allows users to run tools to inspect and debug connections during 
> website development, or for corporate environments to intercept and 
> monitor internal traffic. It is not appropriate for this mechanism to be 
> used to intercept traffic on the public internet."
> 
> <https://security.googleblog.com/2019/08/protecting-chrome-users-in-kazakhstan.html>

A recent change in Firefox does the same (importing OS-level CAs into 
its own trust store):

https://support.mozilla.org/en-US/kb/how-disable-enterprise-roots-preference

Firefox may display a TLS connection error when your antivirus software 
prevents data from being sent to your browser. This happens when your 
antivirus software fails to register itself with Firefox as a valid 
issuer of TLS certificates.

Mozilla has added the Enterprise Roots preference to Firefox as a 
solution to the problem. This preference can be used to import any root 
certificate authorities (CAs) that have been added to the operating 
system to resolve your TLS connection error. You can determine if a 
website is relying on an imported root by clicking the Information icon 
from the address bar.

With Firefox version 68, when a TLS connection error occurs, Firefox 
automatically enables the Enterprise Roots preference and attempts to 
connect again. If the issue is resolved, then the Enterprise Roots 
preference remains enabled. However, you may want to disable this 
behavior, so this article explains how to do just that without 
compromising security.
</quote>

As for MITM and Kazakhstan:
https://blog.mozilla.org/blog/2019/08/21/mozilla-takes-action-to-protect-users-in-kazakhstan/

(same day and action as Google).

-- 
Patrick Mevzek

---

From: Rob Sayre <[email-masked]>
Date: Wed, 21 Aug 2019 22:12:06 -0700

> (same day and action as Google).

Thanks for sending that along. I gather that at least Google, Mozilla, and
Apple acted together today:

<
https://www.zdnet.com/article/apple-google-and-mozilla-block-kazakhstans-https-intercepting-certificate

I didn't know this action would be taken, but I do hope other browser
makers join in.

thanks,
Rob