←back to thread

A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

(follow.agwa.name)
482 points sanqui | 2 comments | 30 Nov 24 21:35 UTC | HN request time: 0.438s | source
Show context
sabbaticaldev ◴[01 Dec 24 01:37 UTC] No.42285451[source]▶
Can someone explain what could be done with that and by whom?
replies(4): >>42285493 #>>42285508 #>>42285512 #>>42286140 #
woofcat ◴[01 Dec 24 01:51 UTC] No.42285512[source]▶
Whomever has this fake certificate can run a server and say it's google.com and windows will say "yep you are" with the little green lock.
replies(2): >>42285605 #>>42287273 #
1. baobabKoodaa ◴[01 Dec 24 09:20 UTC] No.42287273[source]▶
Where? In Edge you mean?
replies(1): >>42287433 #
2. echoangle ◴[01 Dec 24 09:58 UTC] No.42287433[source]▶
And everything that uses the OS trust store, when run on Windows, I assume.