Hacker News Reader

> Your private root CA can be maliciously used to MITM every domain on the Internet

I cannot see how. Do you mean as a specific attack on a computer with the private Root CA installed, if the attacker gets their hands on the Root CA private key?

View on HN

I think OP was envisaging the attack being done by the person whose root CA private key it is.

> I think OP was envisaging the attack being done by the person whose root CA private key it is.

Still very convoluted. I cannot see the problem, beyond some very special cases.

There's two parts. The first is getting access to the private CA's private key. This is easy for insiders who already have access, but challenging for external attackers. The second is performing a MITM attack. You need to establish an in-the-middle network position and then craft certs for the sites you want to intercept. Insiders may already have the needed network position. Outsiders may find this challenging. Crafting a bogus certificate is trivial with a private CA.

Reply on news.ycombinator.com