Yes, I think you’re correct
Comment on What is behind the current Lemmy meme about 4 being a private key?
Indigobunting@lemmy.world 10 hours agoNit: That that key doesn’t technically encrypt traffic, if I understand correctly. It’s used to verify the identify of a website. So someone with this private key can’t directly read internet traffic. They can set up a man-in-the-middle attack, but they’d also have to compromise DNS to pull it off.
panda_abyss@lemmy.ca 10 hours ago
invertedspear@lemmy.zip 59 minutes ago
It’s a little more complex than that. But if you want to encrypt, and you do want your site traffic encrypted, you use site certificate to give the client browser proof that you are who you say you are. You do this by establishing a chain of trust: “I got this proof that I am who I say I am from this major trusted certificate authority” you trust them and they trust me, so we’re all good. You’ve probably seen the warning that a site isn’t secure, and that’s because they let their certificate of trust expire.
This low entropy key means it’s trivial for me to fake that I have that major authority’s trust. The browser needs to be updated to no longer trust that authority. Until it does I can easily fake being anyone and say that compromised site vouches for me. I don’t even need to be a man in the middle, I just need to set up a way that your browser sends you to my fake server instead of the real one. Lots of ways to do that.