Comodo ships Adware Privdog worse than Superfish
Browser vendors need to rethink the mostly blind eye they've been turning toward corporate DPI and silent MITM.<p>I don't think browser vendors are necessarily responsible for Superfish or Privdog, but I do think they play a role when they make design choices that sacrifice more than most users realize at the altar of maximum compatibility without convenient alternative configuration options.<p>Even today, trust agility for CAs in Firefox is still one of the hardest-to-configure parts of the software for non-technical users. In a world of HSTS, why on earth should non-programmers have to click through a kludgy GUI for each of hundreds of CAs just to avoid trusting Chinese, Turkmenistani and various other CAs with no warnings by default? This seems like an area ripe for extension development; e.g. with something like RequestPolicy's categories defined by geography, level of paranoia, etc. - or AdBlock Edge's subscription lists. Firefox could pretty easily incorporate Certificate Patrol functionality and make it more usable for less technical users. And so on.<p>Companies producing this sort of malware deserve to be punished for misleading their customers and putting them at risk, but perhaps another solution is to pressure browser vendors to start thinking about the way crypto gets used with a lot more nuance as a potential attack surface, and from whose vantage point MITM confers <i>transitive risk</i>. When vendors leave those sorts of backdoors quietly open for corporate DPI, users often lose control over who <i>else</i> might try to use a similar type of backdoor.<p>There may be a legal difference between corporate DPI and Privdog, but we should stop pretending that there's a huge technical or ethical distinction between Privdog and browser vendors turning a blind eye to silent DPI against someone who does not get a say in it, and often does not even know about it.<p>Browser vendors hide behind 'compatibility' excuses for crappy defaults and glaringly absent warnings in much the same way PrivDog misleads people; browser vendors just tend to commit sins of <i>omission</i> rather than commission.