New NSA Leak Shows MITM Attacks Against Major Internet Services
Trevor Perrin and I have been working on a dynamic certificate pinning proposal called TACK to help mitigate these types of attacks:  http://tack.ioIn the current state of the world, we're all dependent on CA signatures for each connection we make to a website.  TACK is a layer of indirection away from CA certificates, such that we'd only be dependent on CA signatures the very first time we contacted a website.  It doesn't introduce any new authorities or change the default UX at all.After the Comodo breaches a few years ago, I put together a talk about these types of attacks, where the fundamental problems lie, and why approaches like DANE are similarly ineffective:http://youtu.be/8N4sb-SEpcg?t=4m47s