3 ms·
Does this mean savitech needs to hypothetically set up some mitm attack somewhere and wait for you to send traffic, then they can decrypt and read, or does it m
by elbigbad 9y ago
Does this mean savitech needs to hypothetically set up some mitm attack somewhere and wait for you to send traffic, then they can decrypt and read, or does it mean that they can do that direct from your computer by virtue of that root certificate?
- xythobuz 9y agoThey would need to MITM you somewhere, but that could probably happen in their audio driver that's already installed and running on the target machine.
- deleted 9y ago[deleted]
- jchavannes 9y agoThey would need to MITM you. But take into account that it doesn't need to be Savitech. If Savitech was compromised, an attacker could get access to their private key. In a sense, your security becomes dependent on the security of Savitech. I imagine their private key is not as securely stored as a real CA would store theirs. (e.g. with Superfish, Lenovo included the private key on all laptops, for anyone to grab[1]) [1] https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci...