3 ms·
Yes, there was a very large European root CA that was compromised and was actively being used for MITM attacks except this time the web browser address bar woul
by nbevans 12y ago
Yes, there was a very large European root CA that was compromised and was actively being used for MITM attacks except this time the web browser address bar would still "turn green". Which is pretty much as bad as it gets.
Root CAs are not really trustworthy. Manually trusting a self-signed cert is, probably, more secure in the long term. You take control of trust, rather than delegating it out to some faceless corporation who can be corrupted or hacked.
- davb 12y agoThe issue is how to know when the self-signed cert if trustworthy. I agree that the root CA trust system is not the answer, and web of trust doesn't work in practice, but I don't know how we can know if a self-signed cert is trustworthy in the first place. Besides doing out of band fingerprint verification (assuming the sideband isn't also compromised). That said, I'd be more inclined to trust a self-signed cert of a CA signed one. I don't even know half the CAs that my device trusts, and some I recognise (government ones) I explicitly wouldn't trust.