Comment on Firefox 149 adds built-in free VPN with 50GB monthly data
victorz@lemmy.world 13 hours agoInteresting, okay. Just to be clear, if the middle man, i.e. the VPN, were to listen in on the data exchanged during the TLS handshake, wouldn’t it be able to recreate both parties’ key pairs simply using the same algorithm? If it has all the pieces, so to speak. Or is the tech resistant to that as well?
RaisinCrazyFool@kopitalk.net 11 hours ago
This would require the server’s certificate, which the VPN wouldn’t (generally) have access to.
The key part of this is that server certificates are trusted and verifiable. To the extent that’s true, the process is secure against man-in-the-middle attacks. That’s because the client browser can confirm that the server’s certificate is legitimate, and encrypt its own public key with that server’s public key, so nobody in the middle can read it.
If a man in the middle replaced the encryption keys with their own, then the client would know about it, because it can verify the server’s encryption key and of course it knows its own private key, which has never been transmitted over the wire.
You can read more details on the process here: https://www.ssl.com/article/ssl-tls-handshake-ensuring-secure-online-interactions/
Of course nothing is 100% secure. God only knows how many third parties (like government intelligence agencies) have compromised major certificate authorities. If you have access a certificate authority’s private keys, then you can spoof basically anything.