Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>and silently decrypt/MITM the traffic.

Except it's not silent because you need to expose your misissued certificate every time. Sure, the average joe won't spot it, but all it takes is one security researcher to expose the whole thing. AFAIK there are also projects by google and the EFF to monitor certificates, so the chances of you getting caught are really high. Combined with the fact that no such attacks has been discovered, makes me think that it probably doesn't occur in practice, or at least is only used against high value targets rather than for dragnet surveillance.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: