<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">On Apr 17, 2025, at 9:05 PM, Ron Garret <ron@flownet.com> wrote:<br><div><blockquote type="cite"><br><div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Certificates protect against MITM attacks, which are trivial to mount with wifi hotspots.</div></div></blockquote><div><br></div><div>They used to protect, but again, the cat is already out the bag - this has been disproven multiple times since CAs are run by humanoids who are both susceptible to being shady and being socially engineered (or someone can use the gun technique obviously which is also a form of social engineering).</div><div><br></div><blockquote type="cite"><div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">If I control the network access point someone is using, I control everything: DNS, routing, ICMP, the kitchen sink.</div></div></blockquote><div><br></div><div>This is true indeed and what makes this dangerous is there is a different someone controlling your ’network access point’ along every hop for a given route. Packet manipulation is trivial.</div><div><br></div><blockquote type="cite"><div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">The *only* thing I can't do is provide attestation from a third party that the host serving<span class="Apple-converted-space"> </span><a href="http://paypal.com/">paypal.com</a> possesses the same key that it did the last time the third party tried to talk to it. And that matters because the third party did not talk to<span class="Apple-converted-space"> </span><a href="http://paypal.com/">paypal.com</a> over a sketchy wifi hotspot, it talked to it via a hard connection to a router run by a known and presumably trustworthy party.</div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br></div></div></blockquote><div><br></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">I disagree with this. The browser doesn’t tell me if someone rotated some certs or something. It only tells me if it’s invalid/not issued by one of the infinite CAs.</span></div><div><br></div><blockquote type="cite"><div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">The point is not so much control of the domain name per se, as it is providing attestation of continuity of content between an access over a sketchy internet connection vs one that occurred over a (presumably) less sketchy internet connection. It's easy for me to MITM someone at an airport looking for free wifi. It's a lot harder for me to MITM letsencrypt, and *that* is what matters, not the security of DNS per se.</div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">rg</div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br></div></div></blockquote><br></div><div>The point is you don’t have to MITM lets encrypt. There’s a zillion other money focused CAs you can compromise that aren’t as amazing as lets encrypt.</div><div><br></div><div>Security Theater.</div><div>Bravo.</div><div>Standing Ovation.</div><div><br></div><div><br></div><div>- Andrew</div><div><br></div><div><br></div></body></html>