Comment by pabs3
I feel like that BGP attacks (and outright mistakes) haven't gone away, so I wonder how useful MPIC is these days. Also, hosting companies have been known to MITM their customers connections in order to get valid fake certs.
https://isbgpsafeyet.com/ https://notes.valdikss.org.ru/jabber.ru-mitm/
> I feel like that BGP attacks (and outright mistakes) haven't gone away, so I wonder how useful MPIC is these days.
The actual wording is this:
> The goal of this proposal is to make it more difficult for adversaries to successfully launch equally-specific prefix attacks against the domain validation processes described in the TLS BRs. [emphasis added]
Everyone (everyone in the CA system at least) knows that it will not result to 100% security, but raising the attack from "fooling the sole ISP that the CA used" to "you need to effectively hijack the whole world and that would be very obvious". This is part of the "Swiss cheese" defense-in-depth.
> Also, hosting companies have been known to MITM their customers connections in order to get valid fake certs.
I am not sure if there is a feasible solution here except to be very vigilant (like looking at certificate logs). This is a breach of trust between the hosting company and the server operator.