3 ms·

I mean people don't trust Google's motives but I trust the certificate authorities less... How do we (or Google) know that the CIA and FBI can't create certifi

I mean people don't trust Google's motives but I trust the certificate authorities less... How do we (or Google) know that the CIA and FBI can't create certificates from all the CAs because they have stolen/demanded the Root CA for them? If I was a TLA I'd want the ability to perfectly MITM anyone. I think these questions imply that there needs to be a better way to think about security and trust for web endpoints in the days of the state as a bad actor.

hannob 10y ago
> How do we (or Google) know that the CIA and FBI can't create certificates from all the CAs because they have stolen/demanded the Root CA for them? Well, we know they don't do this on scale, because we'd spot the rogue certs in the certificate transparency logs.
lima 10y ago
> How do we (or Google) know that the CIA and FBI can't create certificates from all the CAs because they have stolen/demanded the Root CA for them? Certificate Transparency.
- zabuni 10y ago
  Which is why Google knew that someone issues a cert for their website: https://security.googleblog.com/2015/09/improved-digital-certificate-security.html https://security.googleblog.com/2015/09/improved-digital-cer... Might be part of the reason they are becoming their own CA.
WildUtah 10y ago
That's why the NSA opened Let's Encrypt, isn't it?
- gcp 10y ago
  Let's Encrypt respects CT: https://crt.sh/?Identity=%25&iCAID=7395 https://crt.sh/?Identity=%25&iCAID=7395