4 ms·
The government could force pc manufacturers to deploy a root CA that they control and then do a MITM proxy to read everything the user is doing, they could also
by shif 9y ago
The government could force pc manufacturers to deploy a root CA that they control and then do a MITM proxy to read everything the user is doing, they could also redirect wikipedia domain to another domain that just acts as a reverse proxy and deploy a legit cert on that other site
- tonysdg 9y agoGovernments already deploy root CAs -- see here: https://security.stackexchange.com/questions/71171/is-there-anything-preventing-the-nsa-from-becoming-a-root-ca https://security.stackexchange.com/questions/71171/is-there-...
- tonyztan 9y agoMost Wikipedia/Wikimedia domains have HSTS preloaded in browsers, preventing redirection without a valid certificate.
- theEXTORTCIST 9y agoAFAIK HSTS doesn't break TLS MITM. A valid x509 certificate is generated by the attacker (using a Certificate Authority trusted by the victim's browser) for the domain the victim is visiting and all is well for both TLS sessions (Client<->Attacker, Attacker<->Server). This all relies on the attacker having access to sign certs from the trusted CA. Certificate pinning in the HTTPS client would mitigate TLS MITM (HPKP).