6 ms·
Does anyone know if it's possible to write a Firefox add-on that could warn you that the site you're connecting to uses one of these less trustworthy or esoteri
by azdle 10y ago
Does anyone know if it's possible to write a Firefox add-on that could warn you that the site you're connecting to uses one of these less trustworthy or esoteric CAs? I've looked through the APIs, but I don't see any hooks for that kind of info.
EDIT: Now that I think about it, it must be possible, Certificate Patrol is looking at the cert info, I'll see how they do it.
- gkoberger 10y agoYou could probably use the website URL + an API (such as https://www.ssllabs.com/projects/ssllabs-apis/ https://www.ssllabs.com/projects/ssllabs-apis/)? There might be a better way, though.
- Retr0spectrum 10y agoIf someone shady was MITMing your traffic, they could just block access to the API. If you wanted to do the checks before loading each URL, it would make things very slow.
- MrRadar 10y agoSince I don't browse Chinese websites I just distrusted the WoSign root and used the Red Jacket add-on[0] to distrust their intermediate certs (at least some of which are cross-signed by other trusted CAs). [0] https://addons.mozilla.org/en-US/firefox/addon/red-jacket/ https://addons.mozilla.org/en-US/firefox/addon/red-jacket/ (this is necessary since there's no built-in UI in Firefox to distrust intermediate certificates: https://bugzilla.mozilla.org/show_bug.cgi?id=585352 https://bugzilla.mozilla.org/show_bug.cgi?id=585352)
- nsgi 10y agoTo some extent this would provide a false sense of security, as if the CA misissues a certificate it wouldn't stop it from being used to hijack your session with an iframe.