3 ms·
Decrypting implies a message sent to the real owner of the domain (using their public key) being intercepted and decoded. If that's the case then no, once you h
by arlort 3y ago
Decrypting implies a message sent to the real owner of the domain (using their public key) being intercepted and decoded. If that's the case then no, once you have encrypted a message with a public key (or more realistically exchanged a symmetric key using the public key) that message is as safe as it can be
With BGP hijacking you could intercept the traffic from the real website, but you still need a valid certificate which is signed (indirectly) by a trusted CA, meaning the attacker would need to add their root CA to the list on the user device
- pieter_mj 3y agothanks, existing traffic is symmetrically encrypted already and can no longer be decrypted by the intercepting party. But future traffic could be. For instance, I found this : https://www.princeton.edu/~pmittal/publications/bgp-tls-usenix18.pdf https://www.princeton.edu/~pmittal/publications/bgp-tls-usen...
- arlort 3y agoOk, yeah, I hadn't thought about the certificate issue phase, though that's a different concern than what you talked about initially. The victim in the paper you mention aren't users but rather the CAs themselves (though the certificates issued can then be used against users)