4 ms·
What is not being said is "Which if any of the CAs have been compromised?" There is this ongoing conversation of "Use HTTPS" (as one of the defense mechanisms)
by newman314 13y ago
What is not being said is "Which if any of the CAs have been compromised?" There is this ongoing conversation of "Use HTTPS" (as one of the defense mechanisms) but there is been very little discussion from what I have seen around the scenario where CAs have been compromised/backdoor'ed.
- tracker1 13y agoI really wish that I could mod this up a LOT ... even with TOR exit nodes + HTTPS, there's still a really good chance of things not being secure...
- newman314 13y agoCompromise the CA (and possibly the pinned certs) and the keys to the bank are yours. No need to spend all that pesky time crunching numbers, factoring etc. The most frightening thing to this is there is no good, widespread alternative...
- joe_the_user 13y agoWhat is not being said is "Which if any of the CAs have been compromised?" That was yesterday. It's being said now.
- 13throwaway 13y agoCAs do not ever see their client's encryption keys. If a CA was compromised someone could only create authentication keys for websites. This type of an attack could work on a single person. It would not work for a large group of people because this type of attack is very easy to detect (by someone who is looking for it) and very traceable.