In this video, it is shown how encryption can be theoretically intercepted without the client noticing it.

In short something in between the connection could make a handshake with the requested server and mimic a cert authority and create a secure connection with the client.

Could this work in the real world breaking integrity?

  • 1
    $\begingroup$ Hint: don't listen to any trap you find on the internet. That's a horrible explanation and the guy clearly doesn't know what he's talking about. $\endgroup$ – Maarten Bodewes Sep 18 '16 at 16:19
  • $\begingroup$ @MaartenBodewes and that's why I asked $\endgroup$ – Patently Paul Sep 22 '16 at 14:30

Yes, this works, but the trick is that you'd need a certificate and private key signed by a certificate authority that authenticates the specific location you are browsing to. This certificate has to be part of a certificate chain that leads to a CA certificate that has to be trusted by your browser. The video makes you believe that a CA has to say "yes" which is incorrect.

So lets go to real life scenarios. Basically there are two possiblities:

  • You somehow have a trusted certificate in your browser that authenticates your connection. This could for instance happen if you're browsing through a company proxy that also proxies the HTTPS connections. These proxies exist; they basically look at the content of the connection and then send it through the HTTPS connection to the server. The proxy then acts as a HTTPS client. In general the IT dept makes sure you've got a company or proxy specific certificate in your browser store. The connection would fail if you'd use a stock browser.

  • A trusted CA is compromised and gives out bad certificates, either deliberately or unintentionally. A good example would be the DigiNotar debacle here in the Netherlands, where DigiNotar signed an end certificate for google.com, among others.

In both cases an unaware user would be tricked into accepting the connection, even though the underlying certificate chain would differ from the original one. Closer inspection could however show that different certificates are being used then the original one.

  • $\begingroup$ ... and if you notice this in the wild and download the mississued certificate, chances are good the CA will be punished or even go out of business. $\endgroup$ – SEJPM Sep 18 '16 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.