News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by riskable on Sunday June 28, 2020 @04:28PM (#23671783)
Not just intercept: Using HTTPS prevents messing with the connection in-flight. So an attacker won't be able to inject their own payload into that web page you just requested.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by CountSessine on Sunday June 28, 2020 @06:26PM (#23672571)
Except you’re using garbage certificates so anyone could MITM you and inject whatever they like.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by bavell on Sunday June 28, 2020 @07:34PM (#23672892)
In what way are self-signed certs garbage? They're essentially the same as ssh certs.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by samus on Sunday June 28, 2020 @10:50PM (#23673916)
That's a separate kind of attack, not intrinsic to the protocol. If the keypair got leaked or a CA misbehaves and issues multiple certificates that can be used for a host, then yes, it can happen.
[ Parent | on HN ]