4 ms·
Is that even possible if Google's SSL certs have Extended Validation? They'd have to have cooperation all the way down to the browser vendors and I can't see Mo
by reedlaw 13y ago
Is that even possible if Google's SSL certs have Extended Validation? They'd have to have cooperation all the way down to the browser vendors and I can't see Mozilla caving that easily.
- dllthomas 13y agoI was referring to cryptographic attacks. Unlikely that they have such, but if anyone does, it's pretty likely to be them.
- amatix 13y agoThere are several governments (Spain, France, Netherlands, Japan) who publicly have Root CAs in the trusted browser list[1]. It seems pretty likely (cf say, Prism) that the NSA has a CA cert where they can generate whatever certificates they want in order to MITM browser SSL communications... [1] http://www.mozilla.org/projects/security/certs/ http://www.mozilla.org/projects/security/certs/
- reedlaw 13y agoCan we remove Root CAs from our browser? Edit: Found the answer: https://wiki.mozilla.org/CA:UserCertDB https://wiki.mozilla.org/CA:UserCertDB