4 ms·

> https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai.. https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai.... > The attack is not extremely

> https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai.. https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai.... > The attack is not extremely sophisticated: the certificate is invalid in user's browsers, and raises a security warning. > https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att.. https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att.... DigiNotar was compromised, not compelled. > http://securityaffairs.co/wordpress/32469/hacking/china-runs.. http://securityaffairs.co/wordpress/32469/hacking/china-runs.... > the connection was established with a self-signed digital certificate. > http://thehackernews.com/2014/10/chinese-government-executes.. http://thehackernews.com/2014/10/chinese-government-executes.... > but the company’s SSL certificate is replaced by the intruders for a self-signed one

vesinisa 12y ago
Fair point. I think the American TLAs know that the very day they are even once caught red-handed with a bogus CA-signed cert, the browser vendors will quickly start beefing up security with measures like DANE, making any attack on HTTPS even harder. This could also be disastrous to the breached CA's business, if browsers start rejecting it, which in turn could have major political implications - the overall revenue of the American CA companies measures in billions. Surely they would have otherwise already done it, right? They certainly have the capability to compel a CA to do it.
higherpurpose 12y ago
France did it: https://nakedsecurity.sophos.com/2013/12/09/serious-security-google-finds-fake-but-trusted-ssl-certificates-for-its-domains-made-in-france/ https://nakedsecurity.sophos.com/2013/12/09/serious-security... http://googleonlinesecurity.blogspot.com/2013/12/further-improving-digital-certificate.html http://googleonlinesecurity.blogspot.com/2013/12/further-imp...
- Buge 12y ago
  I don't see any evidence of an intelligence agency being involved or of the CA being forced to sign the certs. >ANSSI has found that the intermediate CA certificate was used in a commercial device, on a private network, to inspect encrypted traffic with the knowledge of the users on that network.

vesinisa 12y ago

Fair point. I think the American TLAs know that the very day they are even once caught red-handed with a bogus CA-signed cert, the browser vendors will quickly start beefing up security with measures like DANE, making any attack on HTTPS even harder. This could also be disastrous to the breached CA's business, if browsers start rejecting it, which in turn could have major political implications - the overall revenue of the American CA companies measures in billions. Surely they would have otherwise already done it, right? They certainly have the capability to compel a CA to do it.

higherpurpose 12y ago

France did it: https://nakedsecurity.sophos.com/2013/12/09/serious-security-google-finds-fake-but-trusted-ssl-certificates-for-its-domains-made-in-france/ https://nakedsecurity.sophos.com/2013/12/09/serious-security... http://googleonlinesecurity.blogspot.com/2013/12/further-improving-digital-certificate.html http://googleonlinesecurity.blogspot.com/2013/12/further-imp...

Buge 12y ago
I don't see any evidence of an intelligence agency being involved or of the CA being forced to sign the certs. >ANSSI has found that the intermediate CA certificate was used in a commercial device, on a private network, to inspect encrypted traffic with the knowledge of the users on that network.