Hacker News new | ask | show | jobs
by andyjohnson0 964 days ago
> For example, CAs present in Firefox, that might give you pause: Beijing Certificate Authority, China Financial CA, Guang Dong CA

For someone living in the West, what are the consequences of deleting or distrusting those CAs?
2 comments
ajsnigrutin 964 days ago
You lose nothing, gain nothing. It's hard for china to reroute your traffic, and even if they did, what can they do to you after that?

It's your own government that can actually do something bad to you.

(unless you're doing some really really nasty stuff, and china wants to eliminate you for those reasons, and is willing to create a large international incident because of that).

link
SkyBelow 964 days ago
>and even if they did, what can they do to you after that?

An example of what China can do is they can have their workers put pressure on you. Often this pressure is soft, nothing as direct as 'do X or we hurt you with Y'. And often the request, at least at the start, is for something legal and only a bit unethical if even that. A little information to help win a contract, maybe a way to advertise to you why you should go with their vendor for a product, maybe just asking you if a specific coworker seems to have any interest in some odd topic or passing you a resume of someone who seems a good fit for the job. If they can they'll push for more with increasing levels of silver and lead, and if not, they use what they did get to pressure elsewhere.

link
martin8412 964 days ago
Unless it's gotten better, it's super easy for China.. My traffic to EU World of Warcraft servers got hijacked all the time. I don't know if it was malicious or just incompetent Chinese ISPs, but you feel that extra latency when it goes through China.
link
ajsnigrutin 964 days ago
But this wasn't a bgp redirect, this was blizzard doing something... if chinese telcos acted as if they were blizzard telcos, there would be bgp filters and a lot of outrage in a matter of minutes. This is not a small deal.
link
g-b-r 964 days ago
probably none

If you run into some websites which use them the browser will tell you that the certificate is invalid; you can always reinstall them if you prefer.

link