3 ms·
1) Generating certificates on the fly for arbitrary domains has been the usual operating mode for transparent proxies for at least 8 years. 2) There have been m
by mentat 13y ago
1) Generating certificates on the fly for arbitrary domains has been the usual operating mode for transparent proxies for at least 8 years.
2) There have been many public SSL vulnerabilities in the last year. To think that there might be some non-public ones is not a stretch.
3) If anyone can factor very large numbers, it is the NSA. The move to ECC for Suite B has been interpreted to imply this may be becoming more feasible.
- sneak 13y agoLarge-scale active attacks on SSL are infeasible, as many applications (Chrome included) support certificate pinning. Furthermore, this would be easily reproducible evidence that they are actively intercepting (and proxying) traffic. Never happen.