Surveillance firm asks Mozilla to be included in Firefox's certificate whitelist

https://www.zdnet.com/article/surveillance-firm-asks-mozilla-to-be-included-in-firefoxs-certificate-whitelist/

by jakobdabo • 7 years ago

38 13 7 years ago

zdnet.com

kup0• 7 years ago

Why even allow surveillance firms to be CAs in the first place?

ncmncm5• 7 years ago

Who decides whether anybody is allowed to be a CA? Do they have your interests at heart?

dTal• 7 years ago

The article presents this as some kind of difficult decision, but doesn't adequately explain why this should result in anything other than an answer of "no", with a side order of "hell no". Mozilla is under no obligation to add any particular organization to its list of trusted root CAs, and users rely on it for security. Some bizzare notion of "fairness" to a known bad actor doesn't seem like a remotely strong argument to me.

Play stupid games, win stupid prizes.

uodtl2• 7 years ago

The rules are the rules. They want to follow the rules. If they don't follow the rules, they'll be making an exception. What's the point on having rules if you make exceptions?

ncmncm5• 7 years ago

Rules reduce expense, leaving resources to deal with exceptional cases. Applying rules to exceptional cases makes a mockery of both the rules and the organization applying them.

vokep• 7 years ago

Because most of the time the rules are in effect, except for the exceptions.

Rules exist for the purpose they serve, functions they allow to be easier and cheaper. Rules are not made so that rules have been made.

ncmncm5• 7 years ago

Yes, they should be troubled by whether they should even bother to explain why they have rejected it, and removed the QuoVadis authorities.

Agonizing over whether to let them in suggests they have let in other questionable entities. "Fairness" is a smokescreen. Nobody honest needs a certificate from a dodgy authority, and nobody with a certificate from a dodgy authority deserves benefit of doubt.

DyslexicAtheist• 7 years ago

it's a recipe for disaster :(

there are some standards which companies have to comply with in order to be considered a "trustworthy" provider (e.g. for CA's)

https://www.etsi.org/technologies/digital-signature/certific...

I doubt that DarkMatter has any of this (not that this would reduce the risk but it could be used as an argument by Mozilla considering they're stuck between a rock and a hard place.

ncmncm5• 7 years ago

... Hurries to delete QuoVadis and Chinese gov authorities from my Firefox trusted lists.

Seems like I did this a few years back, on a previous system.

zamalek• 7 years ago

I just did this on my work laptop; is there a way to replicate my certificate lists (or, at best, the deltas)?

Chinese gov authorities

How would I identify these?

Surveillance firm asks Mozilla to be included in Firefox's certificate whitelist

Related Stories