Law Enforcement Appliance Subverts SSL

Post by tbrownaw » Thu, Mar 25, 2010, 5:19 PM UTC

codexon wrote: post #39

tbrownaw wrote: post #38

Earlier quoted context omitted.

It comes with a list of the notaries and their public keys. So, the only concern is if your initial download is MitM'ed. http://www.cs.cmu.edu/~perspectives/notary_list.txt

Or the attacker could just block those servers and then spoof that file with new URLs and public keys.