I'm not a security specialist, thus reading this Google Blog post about a fake
*.google.com certificate, raises a lot of concerns, if anyone can impersonate a website, especially a google website, my naive understanding is that this can be used for phishing attacks and identity theft related fraud massively.
What I would like to ask, and please forgive my ignorance, is how a fake certificate useful this way, if I type
X.google.com, it will go to a Google Sub-domain in any case (e.g. fraudster will need to also hack some DNSs / hosts to be able to redirect to his own malicious site, is that correct?)
My question is this, is a fake certificate only useful in combination of a DNS hijack (or any other method that will point the fake cert's target domain to a fraudulent IP, e.g. modifying hosts file etc?)
i.e. I assume it's not useful if the user is clicking on a link a la
givemeyourlogindetails.google.somehoaxdomain.com and tempted to think it's "real" just because the padlock is green (and I assume it won't be green anyway as the domain doesn't match)
I'm sure I'm missing some security 101, but I couldn't be sure I fully understand the big picture here.