←back to thread

A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

(follow.agwa.name)
482 points sanqui | 1 comments | 30 Nov 24 21:35 UTC | HN request time: 0.246s | source
Show context
sabbaticaldev ◴[01 Dec 24 01:37 UTC] No.42285451[source]▶
Can someone explain what could be done with that and by whom?
replies(4): >>42285493 #>>42285508 #>>42285512 #>>42286140 #
woofcat ◴[01 Dec 24 01:51 UTC] No.42285512[source]▶
Whomever has this fake certificate can run a server and say it's google.com and windows will say "yep you are" with the little green lock.
replies(2): >>42285605 #>>42287273 #
bufferoverflow ◴[01 Dec 24 02:13 UTC] No.42285605[source]▶
The certificate is for a specific IP address, no?

And without DNS pointing google.com to that IP address, it's pretty useless.

replies(3): >>42285639 #>>42286509 #>>42287444 #
1. echoangle ◴[01 Dec 24 10:01 UTC] No.42287444[source]▶
> And without DNS pointing google.com to that IP address, it's pretty useless.

On the internet itself maybe, but you can still MITM people on some network, right?