News for hackers. Stuff that matters.

A comment on When did POP and IMAP become a “legacy protocol?”. Parent comment

Re:When did POP and IMAP become a “legacy protocol?” by verisimilitudes on Monday September 26, 2022 @01:35AM (#32979757)
Hey, fellow genius on Hacker News, do note that TLS doesn't protect against state actors, because they can very easily manipulate certificate authorities, and a malicious certificate authority completely removes most protections TLS supposedly provides.
[ Parent | on HN ]
Re:When did POP and IMAP become a “legacy protocol?” by foverzar on Monday September 26, 2022 @02:20AM (#32980035)
It could, if the CAs were globally distributed. Unfortunately currently they are all under the US influence.
[ Parent | on HN ]
Re:When did POP and IMAP become a “legacy protocol?” by tsimionescu on Monday September 26, 2022 @04:26AM (#32980723)
It's enough to compromise one CA for TLS to be entirely defeated - any CA can sign a certificate for any site, and TLS implementations will accept it. The only defense is pinned certificates, but that comes with its own problems.
[ Parent | on HN ]
Re:When did POP and IMAP become a “legacy protocol?” by Avamander on Monday September 26, 2022 @05:41AM (#32981111)
Certificate Transparency is enforced, so it'd be quite easy to detect that compromise by now.
[ Parent | on HN ]
Re:When did POP and IMAP become a “legacy protocol?” by tsimionescu on Monday September 26, 2022 @07:09AM (#32981587)
Sure, but still somewhat after the fact.
[ Parent | on HN ]