3 ms·

Or the private keys to a tonne of Certs from the cert authorities. The massive elephant in the room is the cert authorities..

• QUFB 11y ago
  Not for long, the Wikimedia Foundation intends to implement HPKP: https://phabricator.wikimedia.org/T92002 https://phabricator.wikimedia.org/T92002
• drdaeman 11y ago
  CA private key won't help classic (passive) DPI systems. You have to perform active MITM attack. And if anyone's aware of any ISP anywhere in the world, doing a MITM with a certificate that passes validation, they should really shout about this as loud as they can (or at least whisper to someone who can shout), because it concerns virtually everyone on the Internet.
  • kuschku 11y ago
    Well, CINNIC and the French CA both did this before
    • schoen 11y ago
      Resulting in a lot of shouting. :-)
• schoen 11y ago
  This is apparently an order from the Russian government to individual ISPs. Do you think the individual ISPs have the ability (and desire) to issue fake certs from compromised root CAs to MITM Wikipedia connections? The question in this case is not whether some CA is compromised or malicious, but whether the entities involved have access to such a CA and are willing to use that access. Also, a very wide-scale HTTPS MITM is more likely every month to be detected because there are more and more people looking for it. That may not be true of small-scale MITMs for some time, but it's probably true, for example, for a large-country-wide attack against a major site -- especially a site used by lots of technically sophisticated people who've been given prior warning that something sketchy is going to happen on a particular date!