> real SSL interception is not at all stopped by this
I wasn't aware that SSL interception was possible without a CA trusted by the victim, which is trivial in Enterprise and nigh-impossible elsewhere.
I wasn't aware that SSL interception was possible without a CA trusted by the victim, which is trivial in Enterprise and nigh-impossible elsewhere.
https://www.internetsociety.org/blog/2018/04/amazons-route-5...
https://www.itnews.com.au/news/china-systematically-hijacks-...
https://www.theregister.co.uk/2018/11/13/google_russia_routi...
My first experience with BGP hijacking was accidental and not malicious - and over twenty years ago now: I dropped Sprintlink off the East Coast US for several hours. If LE had been active, I could've taken over any Sprintlink-hosted (or downstream) SSL cert simply by performing challenges to LE. If people aren't doing this out of China and Russia I'd be surprised.
LE might mitigate this with multiple checks (across multiple private links) but it currently doesn't do this: LE checks my challenge only once.