3 ms·
"Backdoors in SSL certificates"? Are you talking about flaws inserted in SSL software, such as OpenSSL? Or do you mean that they likely have root certificates t
by weavejester 12y ago
"Backdoors in SSL certificates"? Are you talking about flaws inserted in SSL software, such as OpenSSL? Or do you mean that they likely have root certificates they can use to perform MITM attacks?
The problem with a MITM attack is that it involves changing the message stream. It's not a passive attack. A MITM attack is unsuitable for wide-scale surveillance, as it would almost certainly be noticed.
- dredmorbius 12y agoRumblings I've heard are compromised roots, or entropy attacks, enabling MITM. SSL/TLS are pretty creaky as it is.
- weavejester 12y agoMITM attacks aren't suitable for mass surveillance. All it would take is for a DDG employee to check the certificate from outside their network and the game would be up. Not only would you know the NSA was using a MITM attack on a global scale, you'd have absolute proof of it. The NSA might be using a zero-day flaw to passively listen in on connections, but the possibility of this will diminish once the OCAP gets around to finishing its audit of OpenSSL.