6 ms·

> All are possible All happened already: 1) Hacked Mongolia CA 2) Dual_EC_DRBG 3) Eternal Blue 4) "NSA Interception In Action? Tor Developer's Computer Get

> All are possible All happened already: 1) Hacked Mongolia CA 2) Dual_EC_DRBG 3) Eternal Blue 4) "NSA Interception In Action? Tor Developer's Computer Gets Mysteriously Re-Routed To Virginia" Ok technically not backdoors and most of them conspiracy myths. Yeah there is a lot out there to go deep down the rabbit hole

wg0 5y ago
Consider this - All download URLs of top browsers get intercepted first and the binary fixed binary response gets returned which is actually patched version of the browser (as most major browsers are open source) containing additional CAs to be trusted. From that point onwards, every HTTPS interaction is just plain text.
- landemva 5y ago
  'containing additional CAs to be trusted.' I continue to be surprised that most people seem OK to keep the junk CAs which are preloaded on phones.
  - jmholla 5y ago
    I realize I am one of those people. How do you tell legitimate/useful CAs apart from junk ones?