Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • See also Is firefox disabling of insecure TLS fallback part of the HSTS spec? (full disclosure: the accepted answer is my own). Commented May 31, 2016 at 11:39
  • 1
    Additionally, while it isn't supposed to happen, it does happen: A Controversial Surveillance Firm Was Granted a Powerful Encryption Certificate (May 27, 2016 15:25 EST). The article title is oversimplified for the general public; the company was granted by Symantec a certificate with the right to sign further certificates turned on, for alleged "internal testing purposes". Commented May 31, 2016 at 11:40
  • Regarding this statement "requires the attacker to have access to a Certificate Authority's private key", isn't it also true that an attacker could spoof the SSL connection if they somehow managed to install their own CA root certificate on the machine? Its also possible on a windows desktop which has IIS installed to run a spoof site locally with a self signed certificate which will be automatically trusted by the browser. Commented May 31, 2016 at 15:44
  • 4
    @rdans If the attacker controls the private key for any CA certificate installed on the victim's system, then yes, that is potentially a viable MITM attack vector for an attacker that has access to the data transmission path. Commented May 31, 2016 at 15:46