"Normally when a user visits a secure website, such as Bank of America, Gmail, PayPal or eBay, the browser examines the websites certificate to verify its authenticity.
At a recent wiretapping convention, however, security researcher Chris Soghoian discovered that a small company was marketing internet spying boxes to the feds. The boxes were designed to intercept those communications without breaking the encryption by using forged security certificates, instead of the real ones that websites use to verify secure connections. To use the appliance, the government would need to acquire a forged certificate from any one of more than 100 trusted Certificate Authorities." http://www.wired.com/threatlevel/2010/03/packet-forensics/ Research paper: http://files.cloudprivacy.net/ssl-mitm.pdf Juha-Matti _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.
