Before I ask my question, I would like to make sure that I understand the settings correctly.
So, the given:
- A client, using some web browser (firefox, for instance) - the Client
- The bank server - the Server
- The Client establishes HTTPS connection with the Server
- An SSL certificate signed by a well known CA is used
- The Client's bank account access password is good and well protected.
Now, I am asking myself what makes it invulnerable to the MITM attack? Imagine that:
- Someone gets a legitimate SSL certficate signed by any well known CA and issued to a certain machine.
- Next, we need to make the HTTP traffic go through this machine. It is possible if the machine is configured to be a router and is located somewhere close to the endpoints - the corporate network or the respective ISP are the ones that come to mind.
- The machine acts as an MITM proxy. Now, the browser should still warn the Client, because the presented certificate is issued to a host different from that in the URL, but examining the certificate would reveal that it is absolutely valid and is issued by a trustworthy CA - it may fool the human into accepting it.
So, my question is this - is it true that the security of online accounting depends on:
- The strictness of the process of signing SSL certificates by well known CAs.
- The security of the corporate and ISP IT labs.
Which is in addition to the power of the math behind the encryption, of course.