3 ms·
Read how Tls works. Many people Can mitm. That’s why we sign applications
by alexnewman 1y ago
Read how Tls works. Many people
Can mitm. That’s why we sign applications
- dns_snek 1y agoIf they can MITM the installation script delivered over HTTPS, they can also MITM the website delivered over HTTPS. You can have 10 step instructions for users to add your PGP signing key and install your APT repository, but what difference does it make? None at all. A malicious website will copy your instructions and replace the signing key and the repository URL with their own.
- alexnewman 1y agoNo because the apps are signed and have it's own chain of trust independent of tls
- deleted 1y ago[deleted]
- Sohcahtoa82 1y agoI've read how TLS works. No, you can't MITM it unless your server or client have been altered to be deliberately insecure (ie, having a server with a self-signed certificate or a client that doesn't verify certificates). If you could, the entire internet would be broken.
- alexnewman 1y agoWhat happens when your certificate authority goes after you