3 ms·
That's only true in a pure eavesdropping scenario. The keys would still allow MITM attacks.
by dlitz 13y ago
That's only true in a pure eavesdropping scenario. The keys would still allow MITM attacks.
- mpyne 13y agoExcept for cert pinning. I think moxie is working on a general form of that right now.
- dlitz 13y agoCert pinning doesn't solve that problem. Cert pinning solves the problem of a compromised CA signing false certificates. If an attacker has the private key of the endpoint, cert pinning will do nothing.
- mpyne 13y agoI.e. the attacker completely simulates the desired endpoint since they have the priv key, DNS and all? I think that makes sense indeed.