3 ms·

How do you know you're not being MitM'd during step 3?

• ethbro 9y ago
  For all reasonable adversary examples shy of panopticon, downloading from multiple physical sites and global proxies and comparing the same roots across downloads should be sufficient, no?
  • omni 9y ago
    Ohhhh gotcha, seems legit. I thought the certs in step 3 were individual site certs, not the roots. Thought he was going for some site-level pinning or something.
    • deleted 9y ago
      [deleted]
• deleted 9y ago
  [deleted]