3 ms·
Even obtaining valid DNSSEC and x.509 is easy, as DE government has its own trusted key subroot. It is a strong case for using key pinning on all levels, from
by AstralStorm 5y ago
Even obtaining valid DNSSEC and x.509 is easy, as DE government has its own trusted key subroot.
It is a strong case for using key pinning on all levels, from routing protocols through DNS all the way to email signatures.
- deleted 5y ago[deleted]
- gruez 5y agoIt's possible, but it would have to be a pretty important target because if it gets discovered, the root would get revoked and can't be used for such purposes again.
- AstralStorm 5y agoThat would be a political landmine to revoke a lawfult interception root. You could do that, but there's nothing stopping German government from issuing another. Did you see anyone ban Turkey or China roots?