How HTTPS works
www.youtube.com
Follow me on Twitter: https://twitter.com/omkarscomicsDo you know that your Internet connection can be tapped just like a telephone line? Your conversation w...

So this video explains how https works. What I don’t get is what if a hacker in the middle pretended to be the server and provided me with the box and the public key. wouldn’t he be able to decrypt the message with his private key? I’m not a tech expert, but just curious and trying to learn.

  • lostmypasswordanew@feddit.deEnglish
    0·
    4 months ago

    All TLS/HTTPS clients have a set of Certificate Authority keys which they trust. Your client will only accept a public key which is signed by a trusted CA’s key. A proper CA will not sign a key for a domain when it has not verified that the entity that wants it’s key signed actually controls the domain.

    • mox@lemmy.sdf.orgEnglish
      0·
      4 months ago

      A proper CA will not sign a key for a domain when it has not verified that the entity that wants it’s key signed actually controls the domain.

      Most browsers trust many certificate authorities from all over the world.

      Any of them could…

      • be compelled by authority
      • be compelled by threat
      • be hacked
      • have a lapse in ethics
      • have a rogue employee
      • etc.

      …and yes, it has happened already.

      HTTPS as most of us use it today is useful, but far from foolproof. This is why various additional measures, like certificate pinning, private CAs, and consensus validation are sometimes used.

      • lemmyvore@feddit.nlEnglish
        0·
        4 months ago

        I urge everybody to read up on CA records in DNS and add them to your domains. They basically say what CA the certs for that domain are supposed to come from. Even if another CA issues valid certs for the domain they would be rejected if they don’t match the CA în DNS. It takes 5 minutes.

      • zeluko@kbin.social
        0·
        4 months ago

        Thats why we now have certificate transparency reports and CA-records.
        Sure not perfect, but at least with a compliant CA it wont just happen in the dark.
        At some point you have to trust someone.

      • state_electrician@discuss.tchncs.deEnglish
        0·
        4 months ago

        Many years ago I manually removed all CAs from my trust store and only added those I needed. Turned out that from roughly 160 trusted root CAs I needed about 10 to 12. I stopped because it often was very difficult to figure out which CA signed the cert for an app that was failing. The final nail in the coffin was when I was late for a business meeting and the only way to get a parking space close enough to my destination was by paying with an app I’d never used before and finding the right root CA under pressure was too much. I really wish we had more and easier control over who we trust.