News for hackers. Stuff that matters.

A comment on Http://www.google.com/wo0dh3ad. Parent comment

Re:Http://www.google.com/wo0dh3ad by mooism2 on Friday January 07, 2011 @06:52AM (#2079294)
I agree TLS should be more widely used. But...

When the government or ISP in question controls its own certificate authority (and many do), they can MITM you even over HTTPS. Yes, it's another speedbump for them to get over. No, it's not going to stop them.

The X.509 security model is broken and needs fixing or replacing.

[ Parent | on HN ]
Re:Http://www.google.com/wo0dh3ad by chaitanya on Friday January 07, 2011 @09:07AM (#2079540)
Are there any certifying authorities which can be considered relatively free of government/corporate control?
[ Parent | on HN ]
Re:Http://www.google.com/wo0dh3ad by wrs on Friday January 07, 2011 @08:07PM (#2081797)
That doesn't matter until browsers start paying attention to which authority signed the certificate.
[ Parent | on HN ]