Kagi finally let me lay Google Search to rest

Re:Kagi finally let me lay Google Search to rest by wutwutwat on Thursday October 12, 2023 @02:18AM (#37854006)

Unless they MITM you and whatever app you’re using doesn’t do cert pinning, or they don’t have a legit root cert that they can sign completely valid certs with

[ Parent | on HN ]

Re:Kagi finally let me lay Google Search to rest by hnben on Thursday October 12, 2023 @03:11AM (#37854328)

> Unless they MITM you

how high would you estimate the odds of this actually happening for lets say mullvad?

[ Parent | on HN ]

Re:Kagi finally let me lay Google Search to rest by wutwutwat on Thursday October 12, 2023 @12:48PM (#37859661)

How would I know? There’s always a VPN new kid on the block everyone shills for. Used to be that ProtonVPN was our savior now it’s nobody even knows it exists.

Point is unless you control every hop in the chain you can’t know it’s safe

[ Parent | on HN ]

Re:Kagi finally let me lay Google Search to rest by juunpp on Thursday October 12, 2023 @12:08PM (#37859143)

To MITM me they'd need the intermediate or root certs of whatever I am connecting to? I don't see how even pinning the cert would help if the chain is invalid to begin with.

[ Parent | on HN ]

Re:Kagi finally let me lay Google Search to rest by wutwutwat on Thursday October 12, 2023 @12:53PM (#37859724)

Yes sorry there was a typo in my earlier comment, but that’s what I was saying. If they have a stolen root cert, or are given one, they could produce 100% valid certs and youd never be able to tell they were doing it. I find it hard to believe the root certs of the internet have been kept safe all these years from the intelligence branches of these governments that are at cyber war all the time. I wouldn’t be surprised to one day learn root certificates were willingly given to intelligence branches for “national security” or whatever

[ Parent | on HN ]