As far as certificate authorities (CAs) build into the browser: One way around this might be that the browsers ship with the CA as required by law, but that one can disable/delete the CA via the UI. I would guess that a law would be passed that says that the browser can't disable/delete certain CAs (perhaps this one also says that). There can be a list of various government CAs that one might want to disable. This does not help if governments can pressure CAs to issue an alernate CA for use in MITM. Does any of the CA transaprency help? What about a way to have people endorse a certficate (i.e. reputation)?
Last Chance to fix eIDAS: Secret EU law threatens Internet security
311–314 of 314 posts
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#312[dead]
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#313[dead]
Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security
#314Earlier quoted context omitted.
TLS 1.3 encrypts server certificate, so it will not be possible to filter such connections out using just passive inspection.
Instead of a pihole, you'd run a https proxy that doesn't trust the certs i guess.
Which https proxy you're referring to? HTTP proxies capable of forwarding HTTPS just offer HTTP CONNECT method, which allows client to tunnel regular TCP connection and HTTPS inside it. These proxies do not do anything with certificates.