I am totally naive to these cat and mouse games, but why does not Google just force SSL in China? They would have to turn off the partial searches feature, which has been shown to leak the cleartext, but I think it would totally fix any sort of censorship. Then again, maybe this type of response works better politically.
A few guesses other than the man in the middle one. One is that China might then just block Google ssl requests completely. Another is that if China did block Google ssl requests completely, it would also break any other google.com services already on SSL, such as gmail. Though of course google could host these on different domains to solve that problem.
Yes, but that would be likely detected, and the CA that had its private key stolen or coerced for government use would be exposed nonrepudiatably. All browser makers would immediately drop the bad certificate. In the case of targeted connections, this may avoid detection though.
You seem to be unaware that businesses (and governments) can legitimately buy keys that allow MITMing SSL connection or they could just be a CA themselves (no problem for China).
It is annoying that people downvote you instead of explaining your error in your assumption about SSL.
Yes, but then that bogus certificate is in the wild. Once once someone has a copy of a bogus certificate, then they can prove that that CA is corrupt. That CA loses its business model. What I am saying does not prevent one-off attacks, but all it takes is one person to capture a bad certificate to discredit a CA. Hence it would not work in a universal censorship scheme as Google is combating. Maybe I am still overlooking something, and I suppose China could just SSL proxy the whole country, which would defeat all of this.
