Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • 3
    Wouldn't they just force the operator of the website to hand over their own certificate, which would make the whole thing completely transparent. If the NSA has to create new certificates for every website, then tracking certificate fingerprints will reveal the eavesdropping. For example, if my company's SSL key fingerprint differs between when I access the website at work and when I access it at home, then I'll know the certificate was compromised. Likewise, if they are only tapping my home internet connection, I can look for fingerprint changes that differ between home and another network. Commented Oct 22, 2013 at 23:16
  • 1
    @Johnny: that would work somewhat, but user laziness to check cert signatures for every secure site they visit would happen most often. Also, some HTTPS sites change certs on a schedule (say every 6 months), which makes it hard to tell if a cert signature change is indeed valid. Commented Oct 23, 2013 at 1:01
  • 7
    @Johnny Also a large chunk of the internet has been using the Root CA transparent interchangeability bug as a feature. Navigating the modern internet with tools like Certificate Patrol is a nightmare of "legitimate" swaps and switches that a spy agency switch could hide within, like a needle in a haystack. I gave up on using Cert Patorl for that reason. The underlying v3 X.509 standard is broken. Commented Oct 23, 2013 at 1:27
  • 1
    @suriv It's not a dubious assertion, it's fact. Check out National Security Letters or the Foreign Intelligence Surveillance Act. Commented Oct 17, 2015 at 2:02
  • 2
    Do some research on your own. See also Key disclosure laws.They can compel a company or individual to hand over an SSL key via court order. FISA deals with secret court orders so if it's related to national security it won't ever see the light of day. If it's in the interest of national security to force a CA to hand over their root signing certificate they'll do it. Of course American CAs are all vulnerable to this. Commented Oct 17, 2015 at 4:01