5 ms·

Could Firefox display an icon or provide a visible warning to users when traffic is being intercepted? The root cert could've been installed by malware, no?

JoshTriplett 11y ago
This seems like a good first step: Firefox should display a persistent, unremovable notification bar that makes it clear that the connection appears MITMed. If people complain about that notification, the answer is "remove whatever malware you have, or complain to your network administrator".
- wyldfire 11y ago
  It's difficult for Firefox to determine this. In this MITM case, Eve is your employer and she's modified the cert store that Firefox implicitly trusts. Now it would be interesting if firefox could distinguish between the cert store that it came with and new certs installed. Another idea would be for users to write an extension that could say "such-and-such cert is my employers and you should create a UI flag when it's being used." I know I looked into that for Chrome and it's impossible since it's not available to the extension system.
  - JoshTriplett 11y ago
    Firefox knows this any time a site has a pinned certificate and that certificate doesn't match, but chains to a certificate in the system trust store that didn't ship with Firefox.
    - wyldfire 11y ago
      Ok, I expected it should be feasible. I wasn't optimistic when I read a Chrome bug that was nofix'd to make certificate info available to extensions. You sound kinda authoritative, are you suggesting that you could propose this change to firefox and it might get accepted?
      - JoshTriplett 11y ago
        > Ok, I expected it should be feasible. I wasn't optimistic when I read a Chrome bug that was nofix'd to make certificate info available to extensions. This doesn't seem like a thing you could easily do from an extension, especially from a Chrome extension. But the browser itself easily has access to this information. > You sound kinda authoritative, are you suggesting that you could propose this change to firefox and it might get accepted? No, not at all; I'm not a Firefox developer. I just have strong opinions on how broken MITM is, and thoughts on how to mitigate it while dealing with the reality that an ultimatum to choose between the browser and the organizational policy will often see the browser lose. Leaving the browser capable of browsing, while showing an unremovable information bar that warns people about something MITMing their traffic, seems like a strong step towards condemning MITM that might actually work.
pfg 11y ago
If malware has write access to your certificate store, it is likely that it could also modify your certificate store or browser in a way that would bypass this warning.

JoshTriplett 11y ago

This seems like a good first step: Firefox should display a persistent, unremovable notification bar that makes it clear that the connection appears MITMed. If people complain about that notification, the answer is "remove whatever malware you have, or complain to your network administrator".

wyldfire 11y ago
It's difficult for Firefox to determine this. In this MITM case, Eve is your employer and she's modified the cert store that Firefox implicitly trusts. Now it would be interesting if firefox could distinguish between the cert store that it came with and new certs installed. Another idea would be for users to write an extension that could say "such-and-such cert is my employers and you should create a UI flag when it's being used." I know I looked into that for Chrome and it's impossible since it's not available to the extension system.
- JoshTriplett 11y ago
  Firefox knows this any time a site has a pinned certificate and that certificate doesn't match, but chains to a certificate in the system trust store that didn't ship with Firefox.
  - wyldfire 11y ago
    Ok, I expected it should be feasible. I wasn't optimistic when I read a Chrome bug that was nofix'd to make certificate info available to extensions. You sound kinda authoritative, are you suggesting that you could propose this change to firefox and it might get accepted?
    - JoshTriplett 11y ago
      > Ok, I expected it should be feasible. I wasn't optimistic when I read a Chrome bug that was nofix'd to make certificate info available to extensions. This doesn't seem like a thing you could easily do from an extension, especially from a Chrome extension. But the browser itself easily has access to this information. > You sound kinda authoritative, are you suggesting that you could propose this change to firefox and it might get accepted? No, not at all; I'm not a Firefox developer. I just have strong opinions on how broken MITM is, and thoughts on how to mitigate it while dealing with the reality that an ultimatum to choose between the browser and the organizational policy will often see the browser lose. Leaving the browser capable of browsing, while showing an unremovable information bar that warns people about something MITMing their traffic, seems like a strong step towards condemning MITM that might actually work.

pfg 11y ago

If malware has write access to your certificate store, it is likely that it could also modify your certificate store or browser in a way that would bypass this warning.