4 ms·
On top of what you mentioned, they would have access to significant metadata, unencrypted traffic, and it is worth assuming that government agencies have the re
by eightysixfour 2y ago
On top of what you mentioned, they would have access to significant metadata, unencrypted traffic, and it is worth assuming that government agencies have the resources to acquire certificates and MITM high value information.
- hiatus 2y ago> have the resources to acquire certificates and MITM high value information. Isn't that mitigated by certificate transparency?
- ls612 2y agoFor WebPKI yes it should be.
- eightysixfour 2y agoObviously this all depends on your threat model at the end of the day, but if assuming a state level actor, I don’t think it is that far fetched to assume they can acquire the original certificate.