4 ms·
Preface: I don't understand this stuff much at all. I was under the impression that stuff gets encrypted with the public key, and can only be decrypted with th
by NoodleIncident 13y ago
Preface: I don't understand this stuff much at all.
I was under the impression that stuff gets encrypted with the public key, and can only be decrypted with the private key. Doesn't owning the private key let you snoop on all traffic, all of the time, forever until they change the keys?
- lstamour 13y agoDepends. This might be useful here: https://www.eff.org/deeplinks/2014/04/why-web-needs-perfect-forward-secrecy https://www.eff.org/deeplinks/2014/04/why-web-needs-perfect-... If really interested in the topic, Google the acronyms on this page: http://www.certificate-transparency.org/comparison http://www.certificate-transparency.org/comparison
- robertgraham 13y agoYou still have to be in a spot to snoop. If you are a random hacker wanting to snoop on a Russian bank, once you get their private key, you have to now tap into the network. This is unlikely to be within your ability. You might fly to Russia and sit in cybercafe's open to catch people on the open WiFi, but it's not something that's easy. On the other hand, as the above comment says, you can use heartbleed in other ways, such as catching people's cookies from memory, then insert those cookies into your own browser and hijack their connection. Among the things I'm famous for is having written a proxy server you can aim your browser through in order to do cookie hijacking: https://github.com/robertdavidgraham/hamster/ https://github.com/robertdavidgraham/hamster/