4 ms·
Not only that but they can happily MITM HTTPS as well. Not all the HTTPS sites use certificate pinning or HSTS.
by StreamBright 7y ago
Not only that but they can happily MITM HTTPS as well. Not all the HTTPS sites use certificate pinning or HSTS.
- TeMPOraL 7y agoIt's a tough problem because certificate pinning kills a lot of legitimate use patterns; it's not something I'd like to see being the default everywhere.
- StreamBright 7y agoYes but this is how many companies protect their HTTPS traffic (including one financial institution I work for).
- cpach 7y agoWhat root cert would they us for that?
- deleted 7y ago[deleted]
- yjqcy 7y agoThe government of my country has at least one certificate that's trusted by Mozilla (and I guess Chrome and Windows too) by default.
- xorcist 7y agoIt won't stay trusted if it is actively used for MITM attacks. At least that's the idea.
- StreamBright 7y agohttps://security.stackexchange.com/questions/71171/is-there-anything-preventing-the-nsa-from-becoming-a-root-ca https://security.stackexchange.com/questions/71171/is-there-...
- StreamBright 7y agoYou mean CA? There are many options depending on which agency and which target you are talking about. They have few options from stealing a CA from a legitimate CA user if the want anonymity or use one that is built in to your browsers or systems somebody else already pointed out in the thread.