You all want another spooky ITsec fact?
There is a massive campaign to tell everyone to get and try out the latest cool vpn software.
For quite some time there was a trivial way to get a TLS certificate for virtually any domain.
So if just one of the vpn providers happened to be a nation state trying to mitm everyones traffic ...
I guess many states also have the ability to generate certificates via their own root certificate.
Is there anyone out there monitoring whether mitm attacks are being done by vpn providers? I know there are trackers out there trying to spot DNS spoofing but I think this is a blind spot.
