2 ms·
I've always wondered, is there a possibility for a state MITM if they manage to control the root-signing authorities? Can't they always replace it with their ow
by rubatuga 9y ago
I've always wondered, is there a possibility for a state MITM if they manage to control the root-signing authorities? Can't they always replace it with their own signed certificate?
- mseebach 9y agoAs I understood it, they'd have to MITM both Keybase.io and every single one of the websites where a given user verifies their identity (and then there's certificate pinning which I would assume the Keybase client would know about and respect, but then again if your download of the client was compromised ..). Not impossible, but there's a lot of logistics to get right. Also, they'd have to do it as you sign up. Once your profile is active and you've followed people and their signatures are cached on your local computer, the root CAs are no longer the single point of failure and MITM'ing becomes impractical. That said, if a state, especially the one you're in, targets you personally, you're going to have a bad time.