this post was submitted on 06 Dec 2024
1663 points (99.1% liked)
Technology
86893 readers
4044 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Make them spend more resources doing deanonymizations. First they have to get the IP from instance admins, then trace the tor routing, then the VPN that I use, then ask for my ISP. Make them do all that work.
(Or maybe they already have access by simply activating their backdoors within Intel ME, AMD PSP, and whatever baseband backdoor on the phones they have, and have just gotten everyone's real identities in an instant, we can't know for sure.)
It wouldn't be impossible. There are like so many different certificate issuers, any one of them collaborating with a government would allow them to create a certificate that would be accepted by your browser.
Still takes more work than just giving them that information.
LpqEO7pXr7bXVlscj0ZN0oqL8KvhakUfDHyMuGSlcuwFlrZ8bkbdk2h9r0RRhJeN
That just would allow a malicious attacker to fake being the server, it doesn't actually compromise the TLS session. So you are talking about a much more sophisticated multi stage attack that needs to be actively executed. This wouldn't at all allow them to record traffic and decrypt later.
The certs authenticate that you are talking to the real server, the symmetric session keys that are usually derived from a diffie helman key exchange have nothing to do with certs. That's two separate (but connected) parts of the transaction to build a TLS session.