4 ms·
Because I can inject code into your page that infects visitors to your blog with malware. The NSAs QUANTUM system does exactly this, waiting for the targeted u
by dsl 12y ago
Because I can inject code into your page that infects visitors to your blog with malware. The NSAs QUANTUM system does exactly this, waiting for the targeted user to load a non-HTTPS page, then injecting javascript to redirect to an attack site.
- chc 12y agoAFAIK HTTPS does not by itself prevent this kind of attack. You need to authenticate the server as well as encrypt the connection or you could just be talking very privately to the NSA.
- dsl 12y agoThe browsers do a pretty good job of authenticating servers, and we have a few projects in place to look for rouge certificates. It's not perfect, but it will only get better.
- jacquesm 12y agoNot that many rouge certificates to look for.
- hueving 12y agoUh, of course it does. If it didn't guarantee the server you were communicating with had the private key for the certificate it is presenting, it would be worthless.
- coldtea 12y agoYeah, because the NSA and such don't have access to certificate authorities in the first place, right?
- kuschku 12y agoWhich is why you are supposed to throw out untrustable Certificate Authorities. In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.
- coldtea 12y ago>In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well. Have vendors done it? Because users will surely not bother. Besides, what makes the other CAs' trustworthy? They are just some companies, with offices, CEOs, etc. Can have ties to the government, deals, pressure on them, or even just plain planted engineers...
- chc 12y agoWell, of course the NSA would have the private key for their own certificate. Having the private key for a previously unknown certificate doesn't, in and of itself, prove that you are not the NSA.