3 ms·
For what is worth Libya owned a trusted CA (maybe still does), which means that MITM would happily work, because they can transfer all the certs to their own au
by fijal 14y ago
For what is worth Libya owned a trusted CA (maybe still does), which means that MITM would happily work, because they can transfer all the certs to their own authority. I don't personally see how this is more secure than my self-signed certificate, which generates a warning that's these days very hard to avoid (even if I do know that the cert is fine)
- tptacek 14y agoStipulate that it's true that Libya owned a browser-trusted CA, and compare situations: With signed certificates, Libya can MITM (unpinned) certificate-backed TLS sessions. With signed certificates, random people cannot MITM (any) certificate-backed TLS sessions. With self-signed certificates, Libya can MITM any TLS session. With self-signed certificates, random people can MITM any TLS session. I'm not seeing the argument you're making here.