Hacker News Reader

Hey, fellow genius on Hacker News, do note that TLS doesn't protect against state actors, because they can very easily manipulate certificate authorities, and a malicious certificate authority completely removes most protections TLS supposedly provides.

View on HN

It could, if the CAs were globally distributed. Unfortunately currently they are all under the US influence.

It's enough to compromise one CA for TLS to be entirely defeated - any CA can sign a certificate for any site, and TLS implementations will accept it. The only defense is pinned certificates, but that comes with its own problems.

Certificate Transparency is enforced, so it'd be quite easy to detect that compromise by now.

Sure, but still somewhat after the fact.

Reply on news.ycombinator.com