How HTTPS works
www.youtube.com
Follow me on Twitter: https://twitter.com/omkarscomicsDo you know that your Internet connection can be tapped just like a telephone line? Your conversation w...

So this video explains how https works. What I don’t get is what if a hacker in the middle pretended to be the server and provided me with the box and the public key. wouldn’t he be able to decrypt the message with his private key? I’m not a tech expert, but just curious and trying to learn.

  • @elrik@lemmy.worldEnglish
    8•6 months ago

    As others have mentioned, a trusted 3rd party signs the correct key so your browser can check the key itself.

    However, it should also be noted that your browser must have a list of trusted 3rd parties and their certificates used for signing in order to perform this check. It’s entirely possible to modify this list yourself. Some examples include:

    • executing your own MITM style “*attack” in order to intercept and analyze local https traffic
    • corporate network inspection and monitoring, where a gateway does the above for all devices on the network which have a CA cert pre-installed through some policy

    So while it’s possible for trusted 3rd parties to issue valid certificates to bad actors, it’s also possible to add anyone (you, your employer, or some bad actors) to the trusted parties list.

    • @Huschke@programming.devEnglish
      2•6 months ago

      Add Norton to that list. They also perform their own MITM attack on your pc to ensure your certificates are “safe”…