News for hackers. Stuff that matters.

A comment on Jeff Atwood's security blunder regarding email. Parent comment

Re:Jeff Atwood's security blunder regarding email by jackowayed on Sunday April 29, 2012 @11:54PM (#3907956)
The packets are routed over the public Internet, but if you're using HTTPS, they'll look like encrypted garbage to anyone who doesn't have Google's SSL private key.
[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by unimpressive on Sunday April 29, 2012 @11:57PM (#3907966)
Though once again in all fairness, the security of SSL is not a guarantee.

(See: http://googleonlinesecurity.blogspot.com/2011/08/update-on-a...)

[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by ravivyas on Monday April 30, 2012 @12:04AM (#3907977)
The DigiNotar case was an anomaly where the certificate provider was compromised. This is a rare case.
[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by sneak on Monday April 30, 2012 @12:57AM (#3908087)
It's nowhere near as rare as you think. There are sub-CA certs issued to private companies all the time, allowing them to MITM any default browser config.

The PKI is now totally broken.

[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by unimpressive on Monday April 30, 2012 @12:15AM (#3908005)
http://www.infoworld.com/t/authentication/weaknesses-in-ssl-...

Seems to happen often enough.

(Then again, 2011 seems to have been something of an unlucky year for security professionals. Just ask RSA.)

[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by ravivyas on Monday April 30, 2012 @02:04AM (#3908219)
Well you got to trust someone... else you should just unplug your computer from the internet :)
[ Parent | on HN ]