3 ms·
Aside: There are literally dozens of CA keys baked into end user applications. An intel agency would only need to force some specific CA to sign a bogus cert if
by verytrivial 12y ago
Aside: There are literally dozens of CA keys baked into end user applications. An intel agency would only need to force some specific CA to sign a bogus cert if that agency somehow managed to not have the private key material to any of them. Any one will do to turn the padlock green, and that cert can be injected in a very targeted way.
The agencies complained a lot in the 90s about this technology, then they stopped complaining. So, they've either stopped doing their job, or ...
- MertsA 12y agoThere's tons of CAs that can subvert security for most sites using SSL but also, if any of those CAs are caught issuing a bogus cert, which the cert presented to the user is proof of, they will be immediately blacklisted like DigiNotar and suddenly a whole CA is gone just for getting caught using it once.
- throwaway7767 12y agoAnd yet, TrustWave gets to keep their certificate despite doing the same thing intentionally (as opposed to accidentally through incompetence). The system does not work.
- verytrivial 12y agoCatching one of these forged certs "in the wild" is harder if it only ever appears on the targets connection. If they happen to be anyone other than the fraction of a percent of users who understand things like "pinning", it is very low risk (today at least). The ability to generate a CA cert trusted by a consumer CA store is a valuable asset that, like any intel asset, must be rationally deployed.
- mike_hearn 12y ago> The agencies complained a lot in the 90s about this technology, then they stopped complaining. So, they've either stopped doing their job, or .... or they realised that nobody was deploying SSL outside of login forms and credit card purchases.