I don't have the time or opportunity to watch a 50 minute video right now, but I found a summary of the talk on the presenter's blog [1]. Interesting stuff! He

I don't have the time or opportunity to watch a 50 minute video right now, but I found a summary of the talk on the presenter's blog [1]. Interesting stuff! He references a paper [2] that discusses a "compelled assistance" attach, where a government can use the law to compel a CA to hand-over a certificate that would certainly be usable for a MITM attack. Bruce Schneier also mentioned this [3]. But this is far from "Businesses (and governments) can legitimately buy root keys that allow MITMing any SSL connection". Businesses can't invoke CALEA (or the UK RIPA[4] law, since we're talking about UK government surveillance) - only governments can do that. And the keys are not really being sold or bought. And I don't see how a government could compel a CA in a different legal jurisdiction anyway. "any CA can MITM the whole internet" No. A CA has access to keys that can be used to MITM a connection that is secured by keys issued by them. Thats not the "whole internet". [1] http://blog.thoughtcrime.org/ssl-and-the-future-of-authenticity http://blog.thoughtcrime.org/ssl-and-the-future-of-authentic... [2] http://files.cloudprivacy.net/ssl-mitm.pdf http://files.cloudprivacy.net/ssl-mitm.pdf [3] http://www.schneier.com/blog/archives/2010/04/man-in-the-midd_2.html http://www.schneier.com/blog/archives/2010/04/man-in-the-mid... [4] http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingd...