5 ms·
No. But no one can verify your certificate. The same principle that should make Verisign trustworthy (centrally recognized / audited trust authority) makes the
by sounds 14y ago
No. But no one can verify your certificate.
The same principle that should make Verisign trustworthy (centrally recognized / audited trust authority) makes them vulnerable to nation-state tampering, or more specifically, eavesdropping.
- guessWhy 14y agoWhy? Verisign merely signs your certificate. It does not even know your private key and hence also can't pass it to governments.
- finnw 14y agoIt is not necessary for the government to have your key; They can impersonate your site (using their own key) if they have the cooperation of the CA.
- jlgreco 14y agoThe trick is that if this were being done on a regular/wide basis, people would notice and have pretty incontrovertible evidence of it. I have no doubt they can do it, but it seems to be consigned to their bag of tricks for special occasions.