> How are they going to MITM communications with certs that never left my machine?

The long game. They:

- make sure you wouldn't be in a position to need to transmit data anywhere that would receive it without CA's in their hypothetical pocket

- manage the evolution of the cloud industry to make sure portable VM's and Containers can have their data archived (both in-RAM, disk, hey just send us the running VM!)

- backdoor'd encryption algorithms from the design and implementation phase to ensure a global unlocking mechanism for any data encrypted by anybody who used a large class of extremely commonly available software

So, you run your own private bank in a cloud VM with tenant managed keys? They backdoor'd the encryption algorithm your cloud VM disk relies on, because they blackmailed one of the developers at the company who developed the hypervisor system used by your provider. Open source project? Perfect. (If you think this is nonsense, then remember the rapid discovery of ancient "bugs" causing all this drama to begin with.)

Your TLS privately generated certs that are 100% foolproof aren't actually used anywhere encrypting the data they want, because it's either worthless, or, available elsewhere perhaps at a different (or same) time.

▲

parineum 3 days ago | parent [-]

And you're saying "they" (red flag) have done this with every cert generated?

▲

ceejayoz 3 days ago | parent [-]

They've most certainly tried.

https://en.wikipedia.org/wiki/Dual_EC_DRBG

https://en.wikipedia.org/wiki/Bullrun_(decryption_program)

If you're a specific target of a nation-state level actor, things get worse; they just grab your hardware mid-shipment on its way to you.

https://www.nbcnews.com/tech/tech-news/report-nsa-intercepts...

▲

parineum 2 days ago | parent [-]

> They've most certainly tried.

And failed.

> If you're a specific target...

If you're a specific target, they have to spend an incredibly number of man-hours and money to get into your private data. This proves my point. This shows the effort required to infiltrate _one_ target and you're suggesting they've infiltrated everything by default.

	▲	ceejayoz 2 days ago \| parent [-]
		> And failed. How would you know about the successes? Thinking this is the one and only time they tried it is... interesting. (Plus: "it was, for seven years, one of four CSPRNGs standardized in NIST SP 800-90A") > If you're a specific target, they have to spend an incredibly number of man-hours and money to get into your private data. No, this demonstrates an actor of that power level doesn't even need to compromise encryption, and can get deeper access to everything, if it's worth it to them.