5 ms·
> If you're in a position and have the motivation to passively eavesdrop, you probably have the hardware to actively eavesdrop as well. Targeted, yes. Wholesal
by thomashabets2 11y ago
> If you're in a position and have the motivation to passively eavesdrop, you probably have the hardware to actively eavesdrop as well.
Targeted, yes. Wholesale, no. When I said pay attention I was referring to the fact that in a post-Snowden world the fact that people do this is not even secret any more.
Edit:
I'm new to HN and don't know why the reply button is missing, but I think you and I have different definition of the word "wholesale". But in any case it's beside the point, since if someone sniffs all Atlantic cables they can see exactly what I do on US servers, while they will only see hostnames and some side channels if it's all SSL.
They will not MITM all SSL connections with a forged cert, just to create a dossier on every living human to be retrieved later if they become "interesting". They will if it's HTTP and you can do it passively.
- CHY872 11y agoNo, it can be done wholesale. For example, a corporate firewall of the kind used in any large business will happily (and cheaply) MITM every TLS connection that goes through it. It'd be easy for an ISP to install such a device for unsigned certs, if the payoff were great enough. ISPs have incentives too (advertising, user tracking, etc).
- bonjarber 11y agoYou are absolutely right that corporations do this. It's important to understand how this is happening though. In order to do so, they must add their own Certificate Authority to your browser so that it accepts a certificate signed by a non-root Certificate Authority as valid. This is easy to manage at a corporate level thanks to things like Active Directory that allow you to install root CA's in the browsers of your domain users. It is far more difficult for an ISP to install a non-root CA in your browser, therefore mitigating this risk.