3 ms·
> They can’t decrypt messages but they are able to track where everything comes from and where it is going. They can’t tell what you’re saying, but they have al
by runjake 14y ago
> They can’t decrypt messages but they are able to track where everything comes from and where it is going. They can’t tell what you’re saying, but they have all they need.
He's talking about SSL here, right? For the record, this is completely incorrect. If "they" have access to a trusted CA (and circumstantial evidence says they do), they can MITM and snoop on whatever they want.
SSL encryption is not secure against state-sponsored attackers and sophisticated criminal enterprises.
- rmc 14y agoIf you are serious about encryption, you can use SSL without the Certification Authority system. Just self sign your own certs and only trust them.
- runjake 14y agoAnd when you eliminate all of the default cert stores, then important things on the standard OSes most people use like Mac OS X and Windows will break, such as online banking, webmail, and security updates.
- nuje 14y agoNo, the thought experiment didn't mention or imply SSL/TLS. Your claim also only applies to the f'd up CA bundle that browsers ship by default, it's not a property of SSL/TLS.