Larry Page addresses PRISM

Re:Larry Page addresses PRISM by dllthomas on Friday June 07, 2013 @05:12PM (#5841932)

"They'd have to MITM SSL traffic largely."

To be fair, if anyone can do this it's precisely these people.

... still not likely, though, I agree.

[ Parent | on HN ]

Re:Larry Page addresses PRISM by reedlaw on Friday June 07, 2013 @05:39PM (#5842131)

Is that even possible if Google's SSL certs have Extended Validation? They'd have to have cooperation all the way down to the browser vendors and I can't see Mozilla caving that easily.

[ Parent | on HN ]

Re:Larry Page addresses PRISM by amatix on Friday June 07, 2013 @08:40PM (#5843060)

There are several governments (Spain, France, Netherlands, Japan) who publicly have Root CAs in the trusted browser list[1]. It seems pretty likely (cf say, Prism) that the NSA has a CA cert where they can generate whatever certificates they want in order to MITM browser SSL communications...

[1] http://www.mozilla.org/projects/security/certs/

[ Parent | on HN ]

Re:Larry Page addresses PRISM by reedlaw on Friday June 07, 2013 @09:27PM (#5843232)

Can we remove Root CAs from our browser?

Edit: Found the answer: https://wiki.mozilla.org/CA:UserCertDB

[ Parent | on HN ]

Re:Larry Page addresses PRISM by dllthomas on Friday June 07, 2013 @06:14PM (#5842369)

I was referring to cryptographic attacks. Unlikely that they have such, but if anyone does, it's pretty likely to be them.

[ Parent | on HN ]