Re:Marking HTTP as Non-Secure
by chc on Friday December 12, 2014 @11:54PM
(#8744210)
AFAIK HTTPS does not by itself prevent this kind of attack. You need to authenticate the server as well as encrypt the connection or you could just be talking very privately to the NSA.
[ Parent
| on HN ]
The browsers do a pretty good job of authenticating servers, and we have a few projects in place to look for rouge certificates. It's not perfect, but it will only get better.
Not that many rouge certificates to look for.
Uh, of course it does. If it didn't guarantee the server you were communicating with had the private key for the certificate it is presenting, it would be worthless.
Well, of course the NSA would have the private key for their own certificate. Having the private key for a previously unknown certificate doesn't, in and of itself, prove that you are not the NSA.
Yeah, because the NSA and such don't have access to certificate authorities in the first place, right?
Which is why you are supposed to throw out untrustable Certificate Authorities.
In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.
>In the same way as TURKTRUST was thrown out by all vendors a few years ago, nowadays you should throw out VeriSign and GoDaddy just as well.
Have vendors done it? Because users will surely not bother.
Besides, what makes the other CAs' trustworthy?
They are just some companies, with offices, CEOs, etc. Can have ties to the government, deals, pressure on them, or even just plain planted engineers...