News for hackers. Stuff that matters.

A comment on Thai government to MITM all internet communications. Parent comment

Re:Thai government to MITM all internet communications by cheshire_cat on Monday May 30, 2016 @02:42PM (#11802494)
I was under the impression that they can't issue Sub-CAs because the pathlen of their Cert is set to 0. [0]

They would have to give their private key to their clients to achieve a MITM attack, right?

[0] https://crt.sh/?id=19538258

[ Parent | on HN ]
Re:Thai government to MITM all internet communications by msbarnett on Monday May 30, 2016 @03:11PM (#11802599)
They might have to deploy their private key on the devices they maintain for their clients, perhaps relying on a secure keystore on-device to try to protect it from client sniffing (presuming quietly selling it to the client isn't part-and-parcel of the deal).

Others have suggested they could provide a cloud-type service to achieve the same result.

[ Parent | on HN ]
Re:Thai government to MITM all internet communications by cheshire_cat on Monday May 30, 2016 @03:23PM (#11802650)
Thank you, do you have a link with more technical explanations?
[ Parent | on HN ]
Re:Thai government to MITM all internet communications by predakanga on Monday May 30, 2016 @07:11PM (#11803736)
I'm not entirely familiar with sub-CA specifics, but CloudFlare (at the very least) has developed a system for deploying SSL with off-site private keys[0]; I imagine that could be used in a situation like this.

[0]: https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tec...

[ Parent | on HN ]