3 ms·
How easy is it, in practice, for a nation state level authority to add a root certificate to people's devices? Adding letsencrypt to my personal server made me
by MarkusWandel 4y ago
How easy is it, in practice, for a nation state level authority to add a root certificate to people's devices?
Adding letsencrypt to my personal server made me realize that if I'm MITM'd by a proxy, the padlock still shows up; merely clicking on it and going down a couple of menu levels (in Chrome "Connection is secure -> Certificate is valid" will reveal that the MITM proxy's root certificate is in use.
If an employer can do this to its laptops, and presumably a cell phone maker to the cell phones it sells, just much protection does https really give you against a nation state level propaganda machine?
- remuskaos 4y agoHm, I think you're mixing some things. A nation state could be embedding root certificates via a vendor, see Lenovo superfish (I know this wasn't done by the government, but that somehow makes it even worse). But a nation state actor also could simply buy the latest exploit from HackingTeam/Cellebrite/GrayKey/<current exploit vendor>. Let's encrypt is secure against MITM as far as I know because you still have to verify you own a given domain somehow. I cannot get a let's encrypt certificate for google.com for example.
- RealStickman_ 4y agoSomeone has to first import the certificate into you systems trust store. With employers that's usually done by joining their active directory. If you're not in the active directory, but using your employers proxy, you will see a warning about an untrusted CA on every https site you visit.