5 ms·
A bit surprised at the shock here, CAs are, for the most part, in the lawful intercept business and have been as long as they've existed. Moxie Marlinspike and
by dpeck 13y ago
A bit surprised at the shock here, CAs are, for the most part, in the lawful intercept business and have been as long as they've existed.
Moxie Marlinspike and others have been talking about this for years. Its a recognized problem, and thats why apps that are serious about protecting communications have been moving to a pinning model.
Obviously this sucks at the browser level, though Chrome protect does this with Google properties (and others?) at the CA level now, but at the app level it's very doable and should be something you're implementing.
- dkl 13y agoPlease give some references about this "pinning model," as I'm having difficulty finding anything via google. Thanks.
- fejr 13y agoParent is refering to public key pinning. Chrome for instance has been doing it the last couple years [1]. Also see Moxie's comment in this very thread. [2] [1] https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html [2] https://news.ycombinator.com/item?id=6381673 https://news.ycombinator.com/item?id=6381673