4 ms·
I see there are safeguards in place. But is it true that it is enough to compromise one CA to compromise my browser? Or would a hacker have to compromise ALL o
by galaxyLogic 6y ago
I see there are safeguards in place. But is it true that it is enough to compromise one CA to compromise my browser? Or would a hacker have to compromise ALL of the 322 certificates?
If the latter then having more certificates would simply mean it is more secure. If the former it would mean having more certificates makes it less secure.
Or is it something in between? Do additional certificates add to the security, or diminish from it?
- coddle-hark 6y agoThe former. To be clear though they’d have to steal a root certificate AND intercept the traffic between your browser and any sites you visit.
- Xylakant 6y agoIt is - generally speaking - enough for the attacker to compromise one CA. Every CA can issue certificates for all domains, with some exceptions where the browser knows which CA should be issuing the certificate. Google chrome has a hardcoded list of high value targets, IIRC. All of that is ignored when you have a local CA trust root, though, like many enterprises do (for their TLS intercepting proxies) And for those CAs, even the safeguards as certificate transparency are moot. As a consultant, I never accept to install one of those CA certs in my trust store. I’d rather go and use a VM or a dedicated machine.