Hacker News Reader

Some already do. Take a look at your preferred trust store.

> How would a country feel that all the data of its people can be decrypted by another company?

This is not how PKI, as currently implemented, works.

If someone has a trusted CA and has access to switches/packets, can't they do a MITM? I thought that's possible.

Yes, one would need access to both for that to be possible. A trusted CA alone (the topic of your question) is not enough.

There are proxies that can dynamically generate certs based on requested domains so the only mitigating controls would be to either cache fingerprints of certs and alert someone if they are different than what other probe nodes are seeing from the rest of the internet or to pin certificates and hardly anyone does this any more. This is currently a manual process so most people would have no idea until it is too late. These would just be missing entries in the crt.sh logs.

Reply on news.ycombinator.com