Re:The State of HTTP in 2022
by danuker on Monday January 02, 2023 @08:40AM
(#34217699)
> So if one of the random little CAs in the root store of your browser issues a rogue cert for “google.com”, it will be logged and seen
The victim might be the only one getting a collision as governments target them (and no security researchers get the compromised public key), and the Superfish cert shows that a collision is simply ignored by the browser.
The victim might be the only one getting a collision as governments target them (and no security researchers get the compromised public key), and the Superfish cert shows that a collision is simply ignored by the browser.