An update on attempted man-in-the-middle attacks

Re:An update on attempted man-in-the-middle attacks by mibbit on Tuesday August 30, 2011 @04:42AM (#2940609)

Has IE switched to auto updating or anything?

I love the fact that Google can push changes out to Chrome users immediately. That's a massive win for everyone.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by 1amzave on Tuesday August 30, 2011 @04:50AM (#2940623)

Really? If Chrome's had updates pushed to it recently, how do I know that my browser itself, as installed on my filesystem, isn't now innately subverted by the Iranian government? (Note the domain in question in this particular case.)

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by dchest on Tuesday August 30, 2011 @05:21AM (#2940677)

I don't know about Chrome's update process, but they can simply have their own verification without root certificates (i.e. just like what most Mac software with Sparkle updater do: keep a public key inside the app, and verify the signature of updates).

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by mibbit on Tuesday August 30, 2011 @07:30AM (#2940951)

The auto-update process should be far more secure than SSL certificates. They'll have keys in the current Chrome which it'll use to check any updates are legitimate before they get unpacked/installed.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by waitwhat on Tuesday August 30, 2011 @12:09PM (#2942038)

They do do this? Or they could do this?

[ Parent | on HN ]