Re: Firewall best practices

Surely the whole thing is about *policies*, not 'devices'. Yes, we knew that since the
very beginning that PKI on the internets is just a cardhouse. But we yet to see a
root CA to commit business suicide such an unusual way (and it is surely a suicide
as detection is easy and chances to do that unnoticed are pretty low).

The problem is, it doesn't necessary needs to be root CA. Just any entity with properly
signed certificate with CA basic constraints set.

On Tue, Apr 27, 2010 at 11:12:40AM -0500, Fetch, Brandon wrote:
> Too late:
> http://files.cloudprivacy.net/ssl-mitm.pdf
> 
> And these devices are already in deployment...now, imagine one of these with a wildcard certificate running at a coffee house, or at the aggregation point within a provider's CO POP...
>