I read another question about an embedded https daemon, which got me wondering:
How might one maintain secrecy about the private key within such an embedded system?
My logic is: If the device ships with the key inside it, and someone can obtain [a version of] the physical device, they can get the data out of it (including the RSA private key.) Right?
Once they have the private key:
- What stops them from sniffing your network traffic, and decrypting everything you send to the server?
- What stops them from pretending to be the device (MITM attack)?