Hacker News Reader

> If Firefox, Chrome and/or Safari block this certificate

For users who are already subject to the MITM, when they try to download a new version of their browser, couldn't the ISP simply serve them a slightly modified version of the new/updated Chrome/Firefox binary which does not blacklist their certificate? It would require a high level of technical expertise, but what could prevent this sort of thing?

View on HN

>...but what could prevent this sort of thing?

If it's on Windows, probably the digital signature[0] of the installer bundle will flag for invalid/unknown signature. For nix you could verify checksums but for Apple, if it's not in the store, I think it's nigh* impossible to do.

[0] - https://docs.microsoft.com/en-us/windows/uwp/packaging/sign-...

Reply on news.ycombinator.com