Flutterby™! : Dark Side

I'm doing some legitimate research to prepare for a couple of upcoming presentations. And I've scared myself as I understand how easy some of the "theoretical" hacks out there are and how well they work. What did I do that was so scary? Trust a certificate authority that I created and then play with something that can create fake, while proxying real sites with that fake CA signed cert to the target system. I quickly caught and recovered credentials to an HTTPS basic auth site, as well as Twitter and Facebook (cookie/session auth, but captured original login/password). My local web browser: No warnings once I trusted and installed the CA root cert.

What I realize now, beyond bench racing / theory, is how important, in the current design of the net, that trusted CA's are. I really don't think they deserve the trust we have given them.

We need a better end to end mechanism.

For reference, my home playground is: OpenWRT with "Karma", and a Linux system with mitmproxy...