News for hackers. Stuff that matters.

A comment on NSA Revelations Cast Doubt on the Entire Tech Industry. Parent comment

Re:NSA Revelations Cast Doubt on the Entire Tech Industry by nwh on Saturday September 07, 2013 @09:26AM (#6345007)
MITM isn't the issue, we assume for the most part that the NSA is a passive eavesdropper. Easier in that situation to sniff and decode with a stolen secret, rather than rewriting traffic on the fly.
[ Parent | on HN ]
Re:NSA Revelations Cast Doubt on the Entire Tech Industry by jaggederest on Saturday September 07, 2013 @09:44AM (#6345050)
Right, but my point is that the CA is the central point of failure for all of those scenarios.
[ Parent | on HN ]
Re:NSA Revelations Cast Doubt on the Entire Tech Industry by nwh on Saturday September 07, 2013 @09:46AM (#6345058)
Not really. For a passive attack the key would have to be stolen from a server rather then the CA, who never sees the private key, rather only the CSR (public key).
[ Parent | on HN ]
Re:NSA Revelations Cast Doubt on the Entire Tech Industry by jaggederest on Saturday September 07, 2013 @09:57AM (#6345079)
We're assuming under the current circumstances that it's backdoored, basically. The NSA definitely doesn't want to have to go knock on doors to collect those private keys.
[ Parent | on HN ]