3 ms·
Subverting SSL/TLS kills a CA when noticed and reported. Hypothetically, if you're identifying targets through other means and diverting their connections at th
by ethbro 10y ago
Subverting SSL/TLS kills a CA when noticed and reported. Hypothetically, if you're identifying targets through other means and diverting their connections at the backbone level before monkeying with them then you're not running that big of a risk, statistically speaking.
Especially not when the CA's alternative is Serious Legal Consequences of ignoring a NSL.
- JoshTriplett 10y agoBrowsers can enforce Certificate Transparency for certificates from a given CA; once they reach the point of enforcing it for all CAs, browsers will no longer trust a certificate issued surreptitiously and not logged in the CT logs. And even before that point, any site using certificate and CA pinning can protect against the use of the "wrong" CA to issue a certificate for their site. > Especially not when the CA's alternative is Serious Legal Consequences of ignoring a NSL. I'd love to see the court case brought by a CA that refuses to kill their entire business. But in any case, eventually, a certificate issued secretly by a CA won't be trusted by any browser, NSL or no NSL.