2026-10-22 07:08 UTC
Replies (3)
-
@Blackmist@feddit.uk 2026-10-22 07:17
Cloudflare is the largest MITM hiding in plain sight.
-
@Supercrunchy@programming.dev 2026-10-22 07:26
It’s actually possible: In theory all the generated keys are added to a public certificate transparancy log. Browsers should check that the key is there (but yout http client library probably doesn’t - and this is why these compromised keys are a problem). Website owners should also check that there are no other certificates in there, and if they see an extra misissued certificate for the government spying something went really wrong at a CA and that CA would probably lose all the credibility and trust. Also when you request a certificate the CA doesn’t get your private keys, so they can’t reuse your cert. Example: ctlogs.dev/search?q=Programming.dev
-
@marcos@lemmy.world 2026-10-22 18:19
Yes, government agencies can do MITM whenever they want. Also, take a look at the remote management functionality of your computer.