Pi-Hole Vs State CA's

[Corso Marche]

So, in the event where you find yourself in a territory where the government is pushing out a state approved Certificate of Authentication which is required to access HTTPS internet services, thusby de-encrypting your internet traffic and supposedly re-encrypting it before it reaches its destination, are there any realistic options to protect privacy ?

Standard VPN apps and programs are blocked, but I've used a manually configured L2TP/IPSec PSK VPN connection up to now. (Presumably it was being ignored as it is less secure than the default connection established by the apps/programs from VPN providers. Am I right in that assumption?)

I use CloudFlare DNS full-time, Google DNS is there as a backup, and the VPN mentioned above should the need arise.

The requirement to install a govt-issued CA however would negate any of the above measures, and nullify HTTPS itself by having another party in the middle.

Any realistic options ? Pi-Hole or similar any advantage in this situation? Presumably attempts to avoid the CA would have your internet traffic sticking out like a sore thumb, and all connections could feasibly be blocked by state telcos?

Thoughts/comments/suggestions welcome...

Edited by Corso Marche on Saturday 20th July 12:10

[Corso Marche]

Just bumping this for the Mon-Fri crew, if anybody has any comment.

[Too Late]

I run Pi-Hole at home
https://scotthelme.co.uk/securing-dns-across-all-o...

I use this to try and avoid search engines tracking search history to them publish adverts based on browsing.

[Corso Marche]

If your ISP is checking for a govt. issued Certificate of Authentication installed on the device will a Pi-Hole setup be any benefit in bypassing such a requirement for a CA though ?

Not easy to know for definite without actually being in that situation and testing it I know, but was hoping somebody might have some in-depth knowledge of the area.

[outnumbered]

It sounds like the government is imposing a transparent HTTP proxy, with TLS man-in-the-middle decryption, between you and the rest of the internet. This creates a whole lot of concerns, since you are entrusting all your internet security to the government, and they could eavesdrop on anything they want to.

Whether you can find a way to sneak traffic through this infrastructure depends on how it's all configured. VPN on a non-standard port seems like an obvious idea.

Whereabouts in the world is this ? If this is true, it doesn't sound like anywhere I'd want to live... But presumably there will be lots of other people working on ways around it too.

[Corso Marche]

That's exactly what it is.

This is the second time in the last five years it's introduction has been attempted.

The optimist in me hopes it will all blow over again, and prove unworkable in the real world with kick back from local citizens, tech companies, security firms etc

If it did become necessary then it leaves everything open to a MITM attack. No security for any of your passwords, correspondence, messaging, bank cards, bank logins etc

I got sick to the back teeth of similar carry on whilst living in South Korea a few years ago, where they insist on digital certs and "security" apps for everything.
But at least there you could ignore it and use the internet uninterrupted, or with a VPN if necessary.

If this govt. make it mandatory and move to shutting off everything if you don't have a cert installed we'll be moving further afield. Pity as it's a lovely place to live with nice people and lots to see and do. It's progressed impressively during the last 20 years or so, and continues to do so but every so often there's a political brain fart like this which doesn't do anybody any favours.

Some info at the link below;

https://thehackernews.com/2019/07/kazakhstan-https...