Technology

58072 readers

4131 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

what if the hacker provided the public key for https connection? (www.youtube.com)

submitted 3 months ago by Moxible@monyet.cc to c/technology@lemmy.world

42 comments fedilink hide all child comments

So this video explains how https works. What I don't get is what if a hacker in the middle pretended to be the server and provided me with the box and the public key. wouldn't he be able to decrypt the message with his private key? I'm not a tech expert, but just curious and trying to learn.

you are viewing a single comment's thread
view the rest of the comments

[–] elrik@lemmy.world 8 points 3 months ago (1 children)

As others have mentioned, a trusted 3rd party signs the correct key so your browser can check the key itself.

However, it should also be noted that your browser must have a list of trusted 3rd parties and their certificates used for signing in order to perform this check. It's entirely possible to modify this list yourself. Some examples include:

executing your own MITM style "*attack" in order to intercept and analyze local https traffic
corporate network inspection and monitoring, where a gateway does the above for all devices on the network which have a CA cert pre-installed through some policy

So while it's possible for trusted 3rd parties to issue valid certificates to bad actors, it's also possible to add anyone (you, your employer, or some bad actors) to the trusted parties list.

[–] Huschke@programming.dev 2 points 3 months ago

Add Norton to that list. They also perform their own MITM attack on your pc to ensure your certificates are "safe"...