3 ms·

There's some interesting additional commentary on the F-Secure Blog (http://www.f-secure.com/weblog/archives/00002228.html http://www.f-secure.com/weblog/archiv

• waitwhat 15y ago
  From that blog post... What can you do with such a certificate? Well, you can impersonate Google -- assuming you can first reroute Internet traffic for google.com to you. This is something that can be done by a government or by a rogue ISP. Such a reroute would only affect users within that country or under that ISP. This is not entirely true... For a short time on Tuesday, internet traffic sent between Facebook and subscribers to AT&T's internet service passed through hardware belonging to the state-owned China Telecom before reaching its final destination -- http://www.theregister.co.uk/2011/03/23/facebook_traffic_china_telecom/ http://www.theregister.co.uk/2011/03/23/facebook_traffic_chi...
  • JoshTriplett 15y ago
    Any ISP or country which sent bogus routes like that would get away with it briefly, before getting blackholed. So, sure, if you just needed a window of a couple of minutes and you didn't mind it making international news, you could do this. Also, any entity trusted only to receive traffic but not to route third-party traffic will typically get limited to routes that lead to its own IP block, making this only an option for entities trusted to actually route third-party traffic. And if any such entity pulled a stunt like this more than once, they'd have a hard time arguing that it occurred accidentally.