An update on attempted man-in-the-middle attacks

Re:An update on attempted man-in-the-middle attacks by dredmorbius on Tuesday August 30, 2011 @04:01AM (#2940530)

I get redirected to http there, but this should show the untrusted CA: https://www.diginotar.com/Products/ExtendedValidationSSL/tab...

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by the1pato on Tuesday August 30, 2011 @04:29AM (#2940584)

I get redirected to http after clicking on the first link, just like you did, but when I visit the URL you posted in Chrome (on OS X), I'm able to view the encrypted page without a warning.

I changed the settings in Keychain Access hours ago.

Does anyone know what's going on?

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by dchest on Tuesday August 30, 2011 @08:34AM (#2941135)

I got the same result. For some reason Chrome trusts intermediate certificate even if the root certificate is marked as untrusted. Screenshot: http://i.imgur.com/qW6V3.png (Chrome 14.0.835.109 beta)

Lock with the warning icon is here because "Unable to check whether the certificate has been revoked."

Maybe their intermediate is signed by some other root CA?

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by dchest on Tuesday August 30, 2011 @05:32PM (#2943359)

Update: filed a bug http://crbug.com/94732

[ Parent | on HN ]