undefined | Better HN

0 pointssaltcured3mo ago0 comments

The popular HTTP validation method has the same drawback whether using DNS or IP certificates? Namely, if you can compromise routes to hijack traffic, you can also hijack the validation requests. Right?

0 comments

zinekeller3mo ago

Yes, there have been cases where this has happened (https://notes.valdikss.org.ru/jabber.ru-mitm/), but it's really now into the realm of

1) How to secure routing information: some says RPKI, some argues that's not enough and are experimenting with something like SCION (https://docs.scion.org/en/latest/)

2) Principal-Agent problem: jabber.ru's hijack relied on (presumably) Hetzner being forced to do it by German law agents based on the powers provided under the German Telecommunications Act (TKG)

traceroute663mo ago

> some says RPKI

Part of the issue with RPKI is its taking time to fully deploy. Not as glacial as IPv6 but slower than it should be.

If there was 100% coverage then RPKI would have a good effect.

j / k navigate · click thread line to collapse