3 ms·
The simplified view given in the documentcloud link begs a question: just which CA certificate(s) is/are controlled by NSA? Because in order to pull that MITM
by bostik 13y ago
The simplified view given in the documentcloud link begs a question: just which CA certificate(s) is/are controlled by NSA?
Because in order to pull that MITM off, they either need to have the target service's CA - or they have the ability to fake any certificate. My guess is on the latter.
And that means at least one commonly accepted CA certificate is effectively compromised.
- deleted 13y ago[deleted]
- chopin 13y agoAfaik it is not necessary that a root CA is compromised. Sufficient would be to compromise any intermediate CA who is not on a revocation list. How to circumvent Googles certificate pinning in Chrome, I have no good idea. They would need to compromise any certificate in the chain.