4 ms·
I suppose the OP is assuming the government has a trusted root that they can create certs from at will. I would be curious to know, were a government able to DN
by kodablah 10y ago
I suppose the OP is assuming the government has a trusted root that they can create certs from at will. I would be curious to know, were a government able to DNS spoof or cert spoof to MITM traffic, which would they choose? Which would be more detectable? I assume Google is basically off limits without local machine access due to pinning and other checks built in to Chrome.
- tptacek 10y agoEveryone assumes that each of the Five Eyes governments can, in a pinch, get any certificate they need issued. What people overlook is that on the modern Internet, browsers themselves form an ad hoc certificate surveillance network. If you get a certificate issued for a site that pins, or create a CT discrepancy, there is a very good chance Google and Mozilla are going to discover the CA responsible. And, as you can see, even if you operate the largest, most important CA on the Internet, Google will, if that happens, fuck your shit up. If you want one (of many) dispositive arguments against DNSSEC, just consider that Google and Apple and Mozilla are not in fact in a position to fuck shit up for .COM. You can't revoke or distrust a TLD: the use of those TLDs is encoded into the brains of hundreds of millions of users. Not so a CA!