5 ms·
Sarcasm? Not sure. But all a government has to do is embed within the endpoint, post-decryption. "Or else."
by a3n 7y ago
Sarcasm? Not sure.
But all a government has to do is embed within the endpoint, post-decryption. "Or else."
- giancarlostoro 7y agoIt is a valid point, it becomes much more obvious that you're snooping if you're trying to MITM. If you weren't snooping, you wouldn't bother trying.
- StreamBright 7y agoNot only that but they can happily MITM HTTPS as well. Not all the HTTPS sites use certificate pinning or HSTS.
- TeMPOraL 7y agoIt's a tough problem because certificate pinning kills a lot of legitimate use patterns; it's not something I'd like to see being the default everywhere.
- StreamBright 7y agoYes but this is how many companies protect their HTTPS traffic (including one financial institution I work for).
- cpach 7y agoWhat root cert would they us for that?
- deleted 7y ago[deleted]
- yjqcy 7y agoThe government of my country has at least one certificate that's trusted by Mozilla (and I guess Chrome and Windows too) by default.
- xorcist 7y agoIt won't stay trusted if it is actively used for MITM attacks. At least that's the idea.
- StreamBright 7y agohttps://security.stackexchange.com/questions/71171/is-there-anything-preventing-the-nsa-from-becoming-a-root-ca https://security.stackexchange.com/questions/71171/is-there-...
- StreamBright 7y agoYou mean CA? There are many options depending on which agency and which target you are talking about. They have few options from stealing a CA from a legitimate CA user if the want anonymity or use one that is built in to your browsers or systems somebody else already pointed out in the thread.
- cpach 7y ago”all a government has to do is embed within the endpoint” That’s a pretty high bar to clear though.
- williamscales 7y agoGiven it's already happened in the US, I don't think it's high enough.
- viraptor 7y agoNot really. NSA requests are backed by LE either directly or... extortion style. https://www.wired.com/2007/10/nsa-asked-for-p/ https://www.wired.com/2007/10/nsa-asked-for-p/
- cpach 7y agoAllright. But they didn’t do it for all ~300M citizens though, did they?
- williamscales 7y agohttps://en.m.wikipedia.org/wiki/Room_641A https://en.m.wikipedia.org/wiki/Room_641A They did it to everyone whose traffic transited ATT's backbone
- cpach 7y agoI haven’t immersed myself into the details of the Room 641A scandal, but it does indeed sound awful. I do not approve of the operations of NSA/Five Eyes. But let my re-phrase my question like this: Do we have any evidence that NSA can perform MITM on TLS 1.3? Using a federal US CA would be one way, tricking a CA to issue fraudulent leaf certificates would be another, but as established elsewhere in this thread, both those ways are quite noisy. Attacking the endpoint is another way, but once Mallory does that, all bets are off.
- samstave 7y agoThis is exactly what Carnivore and PRISM were
- cpach 7y agoAnd how would Carnivore/PRISM strip off the TLS encryption?