4 ms·

I don't get why this was downvoted. The chances are that the NSA has obtained at least some certificate authorities' root certificates must surely be pretty hig

• yellowapple 10y ago
  It's actually even simpler than that: self-signed certs are rampant among mailservers, so it'd be trivial (comparatively speaking) to perform a MITM attack. Hopefully we'll eventually get to the point where everyone is using Let's Encrypt or has otherwise ditched self-signed certs, but until then, the likes of the NSA wouldn't even need to bother with the CAs to snoop on mail traffic.
• MichaelGG 10y ago
  Because using a CA to issue a cert for you improperly is a good way to burn your CA. So it'll probably be used very carefully and in very limited scope because it's detectable and leaves undisputable proof. For SMTP it's different since people aren't watching as closely. -- but then the CA angle is irrelevant because there's no verification. Though I'd be surprised if Google doesn't have some sort of program to look at these things and try to detect MITM or just gather info in general. Didn't they just add a little security indicator to Gmail? Google could probably single handedly force TLS verification on email by saying it'll increase deliverabiliy.
  • deleted 10y ago
    [deleted]
  • randomworkacc 10y ago
    And what if the CA is simply giving away the keys to the NSA? The NSA could then sign as anyone they wanted to.