3 ms·
> It is a low view of the NSA to think that they do not > have the ability to real-time decrypt SSL certs from > every major SSL cert authority. The techno
by jmillikin 13y ago
> It is a low view of the NSA to think that they do not
> have the ability to real-time decrypt SSL certs from
> every major SSL cert authority.
The technology required to break SSL is sufficiently advanced that any organization possessing it would probably have easier ways to collect data, all of which would grossly outmatch all known security precautions. There would be no need for any of these sneaking-around stuff because breaking SSL is an instant win condition.
- nitrogen 13y agoThe only thing required to "break" SSL in the absence of some serious protocol flaw is either the ability to MITM connections with a CA-signed certificate, or possession of the private key used by the server.
- packetslave 13y agoYou should educate yourself on Perfect Forward Secrecy and pinned certificates.