Re:Our First Certificate Is Now Live
by r0bbbo on Tuesday September 15, 2015 @04:31AM
(#10219553)
He would need to be in control of that domain entirely. thecitibank.com is just an address that looks legitimate and is purchasable.
[ Parent
| on HN ]
Ok, I understand.
On a slight side note he may not necessarily need to control the domain entirely, just have access to a privileged email address [1]
However, now it seems you won't even need access to an email address. What would stop someone creating a cert for the real citibank.com and using it for a MITM attack? How many people actually check the green bar?
[1] http://arstechnica.com/security/2015/03/bogus-ssl-certificat...
In the live.fi example, it sounds like Microsoft may have failed to prevent a random user from registering [email protected] as a personal account. Citibank probably won't allow a customer to get that e-mail address!