Adversary-in-the-middle = man-in-the-middle?
Technology
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
First time I've come across the phrase but it sounds like the same thing. It's gender neutral though I guess. Maybe that's it?
It's commonly used and you often see the abbreviation AITM these days. You're right about the reason.
Good to know. Cheers.
We had one compulsory course in English at university. The professor corrected a "man-in-the-middle" I had in a field-specific paper. She preferred "middle man". She did buy that it was an established term in cryptography, though.
It's a term for the attack, yes but not for the attacker
private keys were ... 56

As noted, most browsers have already blocked the intermediate certificates. The exception appears to be Edge running on Windows 10, which at the time this article went live was still connecting to 12 vulnerable hosts.
LOL
I think that this isn't really getting the right attention, about what a massive WTF situation this is...
its a 384 bit certificate and this is the private key
00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
00:00:04
that is just fucking NUTS
that’s a very long way to spell the random number 4
::4
That kind of removes the bit size and hides it in assumption.
It's like winning the lottery
Phew to think how close it is to my private key

SSL has had a broken trust model for decades. We need something truly decentralized and auditable.
Ok, but what would that look like in a way that would have mitigated this situation? Seems likely that such a system could actually exacerbate this specific scenario.
SSL tries to solve several problems at once (identity verification + encryption of connection) over a protocol (TCP/IP) that isn't cryptographically tied together. Some very dedicated, smart people have sketched out some ideas on this. Basically, this compromise only happened because we're relying on a chain of third parties and intermediaries to do this verification of certs.
Web of trust, blockchain-based system (where a name like ebay.com can be registered and publish their own cert, so you can prove whoever owns ebay.com also owns that cert), a TCP/IP replacement that you can derive a key from (there are several interesting proposals here, some of which run on top of IP), are all ways of solving this problem with different tradeoffs.
This biggest problem like with any protocol change is inertia behind SSL. Same reason a number of excellent anti-spam protocol enhancements never made it to be widely accepted in SMTP and now everybody is fleeing to other methods of communicating without SMTPs issues.
Something like DANE, maybe? Only the websites actually using the compromised certificates would be compromised.
