Issue metadata
Sign in to add a comment
|
telecom.kz asks user to install root certificate (MitM valnurability)
Reported by
ibmpc.ma...@gmail.com,
Jun 21 2016
|
||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 Steps to reproduce the problem: Kazakhstan ISP ask users to install trusted certificate on all devices used by end user which allow them do MitM attacks. They even say "If you not install this certificate sites like Google, Mail.ru may not work" Original post (asks to install certificate and provide instructions): http://telecom.kz/certificate What is the expected behavior? This certificate should be banned to prevent end users data leak and maintain privacy. What went wrong? Major Kazakhstan ISP asks users to add trusted certificate to all devices they use. Which is really bad for privacy. Did this work before? N/A Chrome version: 51.0.2704.103 Channel: stable OS Version: Flash Version: Shockwave Flash 22.0 r0 Original post is in Russian. I attached certificated to this report, it also available on original post page.
,
Jun 22 2016
ACKing this bug. I'll follow-up offline dominick
,
Jun 22 2016
I believe we developers and technical specialists can do something against this because if we will not, this new idea of national certificates will rise and make internet a lot less secure. Moreover this possibility of decryption users private data can be used not only by government, it's big valnursbility. As I believe browsers should add all this kind of certificates to internal ban list and do not trust them and keep adding any new certificates.
,
Jun 22 2016
,
Jun 23 2016
The page now returns 404. Marking ExternalDependency, because there's nothing I can share at the present.
,
Jun 24 2016
By the way it still exist in Google cache: http://webcache.googleusercontent.com/search?q=cache:ezbYk9XPY5kJ:telecom.kz/certificate+&cd=1&ct=clnk
,
Sep 1 2016
Cleaning out stale bugs. Not because I don't care, but because there's nothing we're really going to be able to share on this bug anyways :)
,
Dec 8 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by dominickn@chromium.org
, Jun 21 2016