3 ms·
They don't have to have your private key to pull off a MITM. In reality, it is probably secure enough against most adversaries. State level adversaries is a di
by pwnna 13y ago
They don't have to have your private key to pull off a MITM.
In reality, it is probably secure enough against most adversaries. State level adversaries is a different story.. That you need OTR and key verification in person.
- snotrockets 13y agoIf the above reports of not Apple not pinning their certificate, then this isn't secure enough against any adversary that can compel or hack a CA to issue you a certificate in Apple's name. The latter appears to be not as hard as you might imagine. And the recent fail in their SSL/TLS library means you don't even need the help of a CA to create a certificate Apple software would consider valid.