Gmail.com being MITM'd by Iran using this certificate
This type of compromised-CA attack is why I never understood why browsers don't use the OpenSSH model: accept and store (prompting for confirmation) the certificate the first time you connect to a site, then throw up enormous red flags if the certificate ever changes.<p>The Firefox root CA list has dozens and dozens of organizations on it. Could a compromise of any one of them mean that this attack could be repeated?