3 ms·
Not sure how the self-signed cert would make things better. Couldn't an MITM attacker do the exact same thing? Presumably, the MITM attacker would already be th
by organsnyder 12y ago
Not sure how the self-signed cert would make things better. Couldn't an MITM attacker do the exact same thing? Presumably, the MITM attacker would already be the party making the (fraudulent) request to the CA, so they could submit their own fingerprint.
- iancarroll 12y agoI suppose you're correct, I wasn't thinking that the attacker would also submit the request. I guess if you're MITMing CA requests you're screwed anyhow.
- ZoFreX 12y agoYou are positing a MITM on the CA though, which is a bit trickier than MITM'g a user, I would have thought?