3 ms·
Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no? So it's not technically infeasible to
by ethbro 9y ago
Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no?
So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?
- userbinator 9y agoSo it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root? Yse, and that is a very scary thought. China is doing something similar already.
- ams6110 9y agoYou could use a VPN. If you live in a place like China that blocks VPNs, you are screwed, agreed.
- cesarb 9y ago> Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no? Only on old TLS versions. TLS 1.3 changed it so the server certificate is also encrypted.
- catamorphismic 9y agoWhat about SNI?