India has state-mandated spying on network traffic (69B & Telecom Act 2023) so as dumb as this looks, it's possible this could've been purposeful

▲

tptacek 4 hours ago | parent [-]

This is a really, really dumb way of doing online spying (presumably, you mean by running a program of deliberate misissuance) since every cert they issue is recorded in a public cryptographic ledger.

I'm not saying this will never happen, just that rolling out a dramatic infrastructure change for "data sovereignty" just to pull off a SIGINT heist that is almost certain to get your CA distrusted seems like a poor risk/reward calculation. I fully expect IC agencies to get some CAs killed and be fine with that.

▲

waz0wski 3 hours ago | parent | next [-]

Yep, but it was an easy zero-touch MITM vector for billions of devices that's only now being closed down

	▲	tptacek 3 hours ago \| parent [-]
		I'm only pushing back against the idea that a "data sovereignty" rollout of intermediates was cover for an IC operation. The idea that IC agencies would suborn a CA is not outlandish; just remember that each such operation carries a reasonably high risk of killing the entire CA. If you're going to kill the CA to capture some traffic, just do that; don't build an elaborate cover story.

▲

eigenform 3 hours ago | parent | prev [-]

In any case, not much sovereignty to gain from only 8 bits :^(