4 ms·
Sure they will, given Chrome's requirement for CT logs, any attacker-issued certificates will be logged, someone will find the suspicious record, and the method
by theamk 2y ago
Sure they will, given Chrome's requirement for CT logs, any attacker-issued certificates will be logged, someone will find the suspicious record, and the method will likely be burned from all the publicity.
I have no doubt that there maybe a few dozen people in the entire world who would get attacked this way, but the chances it would be me are pretty much zero.
- 8organicbits 2y agoHow often are you reviewing the CT logs for your domains? I posit that's rare.
- immibis 2y agoBTW this attack actually happened with jabber.ru - "law" "enforcement" physically intercepted their Ethernet port, then they got to use their IP address and could issue new certificates.
- debatem1 2y agoDo you happen to have a link or any other information about this?
- immibis 2y agohttps://notes.valdikss.org.ru/jabber.ru-mitm/ https://notes.valdikss.org.ru/jabber.ru-mitm/ https://news.ycombinator.com/item?id=37961166 https://news.ycombinator.com/item?id=37961166
- 8organicbits 2y agoRare was intended to refer to "the monitoring of CT logs". The CA system doesn't protect against an adversary who has physical control of your system.