0

I'm doing some traveling right now, so I've been doing a lot of reading about secure browsing on unprotected public networks. My understanding is that if you're using HTTPS and your browser indicates (by clicking on the button to the left of the address bar in most browsers, for example) that the certificate is signed by a trusted authority then you are safe and you know you're on the intended site. I wanted to know if there is any way to fake the fact that a certificate has been signed. I'm asking this question because I don't really understand the process of verifying that a certificate is properly signed. I'm guessing that your computer has to go to the internet to check the validity of a certificate. In this case, could a hacked DNS send you to a fake version of the CA site and say that a certificate is legit, even when it's not? Is there any other way to fake that?

3

The keys that are used to verify certificates are already installed on your computer. If you're on Windows you can view them using the Certificate Manager. If you expand the "Trusted Root Certificate Authorities" you can see the keys stored on your machine.

So a hacked DNS cannot override these keys. If you're curious about how certificates fit into the big picture, you can read about the chain of trust.

3
  • 1
    OTOH, if whoever has compromised his DNS responses also has a copy of the other site's SSL certificate, they could do Bad Things.
    – Bandrami
    Dec 22 '13 at 13:38
  • Yes, but they're unlikely to have that. Your average botnet operator is not going to have access to Yahoo's certificate. The NSA might though, but even then it would be difficult for them to get hold of it - certificates are supposed to be closely guarded. Dec 22 '13 at 14:33
  • There's certainly a risk of trust being misplaced, but that's a debate that's systemic to the entire mechanism of chaining trust. People who are really curious what that padlock actually means would do well to read up on how public key infrastructure works.
    – Svend
    Dec 22 '13 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.