4 ms·
From that blog post... What can you do with such a certificate? Well, you can impersonate Google -- assuming you can first reroute Internet traffic for google.
by waitwhat 15y ago
From that blog post...
What can you do with such a certificate? Well, you can impersonate Google -- assuming you can first reroute Internet traffic for google.com to you. This is something that can be done by a government or by a rogue ISP. Such a reroute would only affect users within that country or under that ISP.
This is not entirely true...
For a short time on Tuesday, internet traffic sent between Facebook and subscribers to AT&T's internet service passed through hardware belonging to the state-owned China Telecom before reaching its final destination
-- http://www.theregister.co.uk/2011/03/23/facebook_traffic_china_telecom/ http://www.theregister.co.uk/2011/03/23/facebook_traffic_chi...
- JoshTriplett 15y agoAny ISP or country which sent bogus routes like that would get away with it briefly, before getting blackholed. So, sure, if you just needed a window of a couple of minutes and you didn't mind it making international news, you could do this. Also, any entity trusted only to receive traffic but not to route third-party traffic will typically get limited to routes that lead to its own IP block, making this only an option for entities trusted to actually route third-party traffic. And if any such entity pulled a stunt like this more than once, they'd have a hard time arguing that it occurred accidentally.