An update on attempted man-in-the-middle attacks

Re:An update on attempted man-in-the-middle attacks by artursapek on Tuesday August 30, 2011 @01:35AM (#2940257)

Wow, the security features Chrome used to nullify the attack were just implemented in June. I wonder if that was a reaction to another incident like this, or if it was just good foresight?

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by tptacek on Tuesday August 30, 2011 @01:48AM (#2940285)

They ship one of the Big 4 browsers and run the Internet's most popular mail server (and thus biggest TLS target). They're uniquely poised to do things like this.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by waitwhat on Tuesday August 30, 2011 @12:16PM (#2942069)

the Internet's most popular mail server

It is my understanding that gmail is dwarfed by both Hotmail and Yahoo! Mail.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by mukyu on Tuesday August 30, 2011 @09:30AM (#2941314)

http://blog.chromium.org/2011/06/new-chromium-security-featu...

> In addition in Chromium 13, only a very small subset of CAs have the authority to vouch for Gmail (and the Google Accounts login page). This can protect against recent incidents[1][2] where a CA has its authority abused, and generally protects against the proliferation of signing authority.

[1] http://googleonlinesecurity.blogspot.com/2011/04/improving-s...

[2] http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by Natsu on Tuesday August 30, 2011 @07:43AM (#2940997)

This isn't the first time something like this has happened. I don't know if they did it in response to any one particular incident, but they have every reason in the world to implement something like that.

[ Parent | on HN ]