6 ms·
Given the episode where stolen Realtek certificates been used for years by a government-made malware, I think we should not be so sure that they can't do that.
by motoboi 12y ago
Given the episode where stolen Realtek certificates been used for years by a government-made malware, I think we should not be so sure that they can't do that.
A single request going through a bogus certificate emitted by NSA "acquired" CA would be hardly detected.
Or, given the fact that they could indeed broke keys, they could simply do a man-in-the-middle, instead of a man-in-the-side.
- Dylan16807 12y agoA stolen key is a server-being-hacked problem, not a CA problem. If the server is hacked, game over. There are browser extensions that detect bogus certificates; there's a good risk of catching them.
- SG- 12y agoShould we pretend the NSA and various organizations don't have the means to infiltrate a CA?
- Karunamon 12y agoAgain, pinning is a realistic countermeasure to this.
- motoboi 12y agoCertificate Authorities normally run as software on a box somewhere. Sometimes they keep this box offline, but they need to keep a sub-CA online somewhere, or they wouldn't be able to issue certificates. So, a CA private key and public certificate can be compromised in much the same way a single server certificate. With a CA private key and public certificate, one can easily emit a bogus certificate for *.google.com or any other domain name. If this CA public certificate is trusted by the browser, a user would hardly notice.