2 ms·
Or it could just fiddle with the browser directly. Why is trusting explicitly user-supplied CAs such a bad thing?
by JoachimSchipper 16y ago
Or it could just fiddle with the browser directly. Why is trusting explicitly user-supplied CAs such a bad thing?
- wladimir 16y agoHe has the thread model backwards. If your advisary already can modify files on your computer, you have other things to worry about than SSL being compromised through the network. The malware could just as well intercept your data before it is encrypted, for example, by installing a rogue SSL library. No need for sniffing and fake certs.