News for hackers. Stuff that matters.

A comment on Russian Hackers Stole NSA Data on U.S. Cyber Defense. Parent comment

Re:Russian Hackers Stole NSA Data on U.S. Cyber Defense by tlrobinson on Thursday October 05, 2017 @01:45PM (#15411004)
I believe keda's point is it's served over HTTP not HTTPS so there's no way to verify you're not being MITM'd when looking at it.

(A possible workaround is to check via multiple connections, check Google's cache, etc)

[ Parent | on HN ]
Re:Russian Hackers Stole NSA Data on U.S. Cyber Defense by strictnein on Thursday October 05, 2017 @02:02PM (#15411172)
I mean, sure, but if you're sending him a PGP encrypted message, and his public key was messed with, the end result would just be his inability to open the message.

I think his actual point was to try and discredit the messenger.

[ Parent | on HN ]
Re:Russian Hackers Stole NSA Data on U.S. Cyber Defense by tlrobinson on Thursday October 05, 2017 @02:09PM (#15411257)
The attacker would then be able to read your encrypted messsage (and possibly re-encrypt it with the original key before forwarding it)

Also, PGP keys may also be used to sign software or other public messages (not a typical use-case for journalists, though)

[ Parent | on HN ]
Re:Russian Hackers Stole NSA Data on U.S. Cyber Defense by strictnein on Thursday October 05, 2017 @02:12PM (#15411286)
You're kind of out in the weeds now.

Also, you don't sign software or whatever with a public key, so I'm not 100% sure you understand how this works.

[ Parent | on HN ]
Re:Russian Hackers Stole NSA Data on U.S. Cyber Defense by codedokode on Thursday October 05, 2017 @02:45PM (#15411581)
HTTPS won't help against attacker that has a jurisdiction over CA and can force them to issue a certificate.
[ Parent | on HN ]