"But software downloads don't need to be HTTPS, there's nothing secret about them" </sarcasm>https://twitter.com/Snowden/status/972110541408952320 …
-
-
Step one: modify DNS of relevant ccTLD Step two: use modified DNS to get legitimate CA to issue a certificate to the relevant government.
-
Assuming the dns is in your country. And then it'll be logged to CT and two days later your operation is in the news.
-
At first I did not understand the problem, then I realised that I very rarely encounter this issue on linux. Much more common on windows (and mac?) to install software from random sources.
End of conversation
New conversation -
-
-
and with HPKP it also has/had (depending on browser) and effective way to prevent such attacks without one checking the CSP (TOFU, of course, but MITM cannot happen all the time, e.g. one may travel)
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.