

MITM HTTPS traffic without a key doesn’t really let you do much of anything, especially with stuff like HSTS. You can mess with DNS, but the whole certificate authority thing is meant to make it so you can’t redirect someone’s traffic to a malicious server.
This leaked private key completely destroys that guarantee, making it extremely scary. ~Plus, saved traffic for any site signed by this key which didn’t use PFS will be subject to post-facto decryption.~
edit: I don’t know wtf I was thinking, the decryption thing is nonsense.


You’re absolutely right, I had shit all mixed up in my head. Oops 😅 thank you for the correction.