This is bad: the UAE's favorite sleazeball cybermercenaries have applied for permission to break Mozilla's web encryption

Remember Darkmatter, the UAE-based cybermercenaries who worked with the beltway bandit firm Cyberpoint to recruit ex-NSA spies to infiltrate and expose dissidents, journalists, even children who opposed the despotic regime in the Emirates? (Darkmatter is also one of the least-discriminating cybermercenary bands in the world, available to help torturers, murderers and thugs hang onto power by attacking opposition movements and letting the secret police know who to arrest, torture and kill).

Now Darkmatter has applied to Mozilla to become a "Certificate Authority," which means they'd get the ability to produce cryptographically signed certificates that were trusted by default by Firefox and its derivatives, giving them the power to produce cyberweapons that could break virtually any encrypted web session (though Certificate Transparency might expose them if they're careless about it).

And since Moz's root of trust is used to secure Linux updates, this could affect literally billions of operating systems.

Without being too hyperbolic about this: HOLY FUCKING SHIT IS THIS A BAD IDEA.

Actually, it's bad already: Digicert division Quovadis has already issued an "intermediate" certificate to Darkmatter, which could allow the company to undertake all kinds of genuinely horrible shenanigans with your web-session. Yes, you.

As Cooper Quintin writes on EFF Deeplinks, this is a terrible idea and Mozilla should tell them to go pound sand. Moreover, Moz should revoke Darkmatter's intermediate cert. The root of trust is for entities committed to helping improve encryption and privacy: Darkmatter's mission is to subvert encryption and destroy its targets' privacy.

Update: Moz is on it! Read the rest