Re:Let's Not Encrypt (2019)
by 1718627440 on Wednesday October 15, 2025 @05:37AM
(#45590027)
When someone MITMs the DNS request, the domain IS resolving to him. What determines who is the MITM and who is not? When I create an account with the "MITM", and then later the "MITM" goes away, THEN I'm sending my account data to some third-party, because at the time of me deciding who is that website it was the "MITM" who was the second party.
I think you've fundamentally misunderstood the problem. Nobody here is talking about the domain resolving to ISP.
We're talking about an MITM attack where a middle-man (doesn't even need to be the ISP, it could be a router in the middle acting like middle-man) intercepts our request and serving its own public key instead of the actual server's public key so that it can carry out an MITM attack.
With TOFU, there is no way to detect this attack the first time I am connecting to the website. Once you have foolishly trusted the middle-man's public key, you may not notice any problem for months or years. Then one day, the middle-man may decide to misuse your credentials that it has collected during MITM attack.