3 ms·
It could, if the CAs were globally distributed. Unfortunately currently they are all under the US influence.
by foverzar 4y ago
It could, if the CAs were globally distributed. Unfortunately currently they are all under the US influence.
- tsimionescu 4y agoIt's enough to compromise one CA for TLS to be entirely defeated - any CA can sign a certificate for any site, and TLS implementations will accept it. The only defense is pinned certificates, but that comes with its own problems.
- Avamander 4y agoCertificate Transparency is enforced, so it'd be quite easy to detect that compromise by now.
- tsimionescu 4y agoSure, but still somewhat after the fact.