An update on attempted man-in-the-middle attacks

Re:An update on attempted man-in-the-middle attacks by ajb on Tuesday August 30, 2011 @09:55AM (#2941432)

There are lots of people between 'a HN reader' and 'your grandmother'. There will always be people who don't understand what a CA is; but the more people who do, the more pressure there will be for them to do their job correctly.

Also, they don't need to understand the technical details. If every time they go to their bank it says 'connection to your bank certified by verisign', and then one day it says 'certified by <someone else>', then a cautious person will be suspicious, even if they are completely nontechnical.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by dpark on Tuesday August 30, 2011 @10:44AM (#2941636)

There are much better ways to notify users than trying to convince them of the value of monitoring their bank's CA. The browser could simply keep track of the cert and notify the user if it changes unexpectedly. This doesn't require the user to understand anything new, and it still works in the case that the fraudulent cert is signed by Verisign.

[ Parent | on HN ]