An update on attempted man-in-the-middle attacks

Re:An update on attempted man-in-the-middle attacks by dschobel on Tuesday August 30, 2011 @02:31AM (#2940367)

Was the CA definitely complicit in this attack? I always assume that private companies have little recourse at state scales of force.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by jbri on Tuesday August 30, 2011 @02:43AM (#2940402)

Either the CA was complicit, or they weren't secure. Regardless of which it is, the CA's root certificate is not trustworthy.

If they were hacked into, spoofed into giving out a certificate, or raided by special forces and had data physically stolen from their servers, then perhaps they can generate a new key and have that become trusted once they've taken steps to ensure something like this doesn't happen again.

But there's no way anyone can trust their old root key anymore.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by tlrobinson on Tuesday August 30, 2011 @02:39AM (#2940383)

Does it matter whether they were complicit or simply compromised? Either way they shouldn't be trusted.

[ Parent | on HN ]