3 ms·
I find it hard to believe that a government agency couldn't easily present a forged certificate perceived as valid by popular browsers if they were so inclined.
by michaelmior 13y ago
I find it hard to believe that a government agency couldn't easily present a forged certificate perceived as valid by popular browsers if they were so inclined.
- tptacek 13y agoThey can, which is why Google pins certificates, and why there are dynamic pinning proposals.
- spindritf 13y agoCouldn't you also pin a certificate if it was distributed over DNS? DANE would make setting up ssl simpler for operators of small sites while not compromising the ability of big players, like Google, to deploy their own security mechanisms.