News for hackers. Stuff that matters.

A comment on MITM on HTTPS traffic in Kazakhstan. Parent comment

Re:MITM on HTTPS traffic in Kazakhstan by coldpie on Thursday July 18, 2019 @02:21PM (#20472568)
Shoot, I hadn't even considered software updates. If this is installed at the system level, they could MITM any software update mechanism that doesn't use cert pinning, couldn't they? Woof.
[ Parent | on HN ]
Re:MITM on HTTPS traffic in Kazakhstan by filleokus on Thursday July 18, 2019 @02:55PM (#20472894)
Yep... I wonder how common it for "sensitive" software to neither use pinned certs nor some package level signing? But probably common enough that it can be abused...
[ Parent | on HN ]