4 ms·

I think most non-EV SSL certificates these days are "verified" by sending a message to whatever e-mail address you have on file in your whois record. Also on C

• Someone1234 12y ago
  Chrome's certificate pinning database doesn't scale at all (i.e. it works on less than 0.01% of the internet). As to the whois thing, what is stopping me from hijacking a domain, changing the whois and then generating keys? The webadmin might never even know. You don't even need access to their email. Or to put it more realistically: What is stopping the NSA from pressuring a domain registrar into altering the whois for a brief period in order to generate MITM keys?
  • pauldino 12y ago
    Nothing, really. But that is the situation today.