3 ms·
The CA system and hence https/TLS is already backdoored, by construction. Any of root CA’s that your browser trusts can man-in—the-middle you unless you keep tr
by onedognight 3y ago
The CA system and hence https/TLS is already backdoored, by construction. Any of root CA’s that your browser trusts can man-in—the-middle you unless you keep track of and pin certificates like Google does. These roots CAs are run by random companies and governments around the world. All of them have equal precedence in browsers.
- layer8 3y agoIt’s not that easy. They would also need to MITM the actual traffic, or the DNS.
- onedognight 3y agoSame with plain http.
- basique 3y agoAny fake certificates the malicious CA signs will have to be written to a Certificate Transparency log, which would make noticing the fact that the CA has done something like this easy.