Re:MITM on HTTPS traffic in Kazakhstan
by JoshTriplett on Thursday July 18, 2019 @02:36PM
(#20472738)
> What prevents us from having to trust Verisign (or its employees) or a government warrant, etc. to not do the same?
Certificate Transparency. Current browsers are moving to not trust any certificate whose issuance wasn't publicly logged. That doesn't prevent an attacker from issuing an MITM certificate, but doing so would permanently burn a CA. (At least, once the policies are in place and enforced.)
Certificate Transparency. Current browsers are moving to not trust any certificate whose issuance wasn't publicly logged. That doesn't prevent an attacker from issuing an MITM certificate, but doing so would permanently burn a CA. (At least, once the policies are in place and enforced.)