3 ms·
You seem to be unaware that businesses (and governments) can legitimately buy keys that allow MITMing SSL connection or they could just be a CA themselves (no p
by 4ad 14y ago
You seem to be unaware that businesses (and governments) can legitimately buy keys that allow MITMing SSL connection or they could just be a CA themselves (no problem for China).
It is annoying that people downvote you instead of explaining your error in your assumption about SSL.
- hasker 14y agoYes, but then that bogus certificate is in the wild. Once once someone has a copy of a bogus certificate, then they can prove that that CA is corrupt. That CA loses its business model. What I am saying does not prevent one-off attacks, but all it takes is one person to capture a bad certificate to discredit a CA. Hence it would not work in a universal censorship scheme as Google is combating. Maybe I am still overlooking something, and I suppose China could just SSL proxy the whole country, which would defeat all of this.
- 4ad 14y agoYou are very confused about how SSL in the context of HTTP works. Here's the best talk I know of this subject: BlackHat USA 2011: SSL And The Future Of Authenticity: http://www.youtube.com/watch?v=Z7Wl2FW2TcA http://www.youtube.com/watch?v=Z7Wl2FW2TcA