New NSA Leak Shows MITM Attacks Against Major Internet Services
Trevor Perrin and I have been working on a dynamic certificate pinning proposal called TACK to help mitigate these types of attacks:  <a href="http://tack.io" rel="nofollow">http://tack.io</a><p>In the current state of the world, we're all dependent on CA signatures for <i>each</i> connection we make to a website.  TACK is a layer of indirection away from CA certificates, such that we'd only be dependent on CA signatures the very first time we contacted a website.  It doesn't introduce any new authorities or change the default UX at all.<p>After the Comodo breaches a few years ago, I put together a talk about these types of attacks, where the fundamental problems lie, and why approaches like DANE are similarly ineffective:<p><a href="http://youtu.be/8N4sb-SEpcg?t=4m47s" rel="nofollow">http://youtu.be/8N4sb-SEpcg?t=4m47s</a>