News for hackers. Stuff that matters.

A comment on MITM on HTTPS traffic in Kazakhstan. Parent comment

Re:MITM on HTTPS traffic in Kazakhstan by filleokus on Thursday July 18, 2019 @02:19PM (#20472545)
Going back to normal, i.e the browser saying that the presented certificate is invalid, yes. But you will not be able to browse anything over a HTTPS connection. (Or do other stuff over PKI based TLS, i.e downloading software updates etc.)
[ Parent | on HN ]
Re:MITM on HTTPS traffic in Kazakhstan by coldpie on Thursday July 18, 2019 @02:21PM (#20472568)
Shoot, I hadn't even considered software updates. If this is installed at the system level, they could MITM any software update mechanism that doesn't use cert pinning, couldn't they? Woof.
[ Parent | on HN ]
Re:MITM on HTTPS traffic in Kazakhstan by filleokus on Thursday July 18, 2019 @02:55PM (#20472894)
Yep... I wonder how common it for "sensitive" software to neither use pinned certs nor some package level signing? But probably common enough that it can be abused...
[ Parent | on HN ]