4 ms·

If you want secure browser access to some resource (for values of 'secure' where it matters more than your bank account but less than situations in which you wo

by __jal 9y ago

If you want secure browser access to some resource (for values of 'secure' where it matters more than your bank account but less than situations in which you wouldn't trust _any_ browser), you really need to remove certs from any commercial CA and install only the CA you need.

acqq 9y ago
I know that it is possible to somehow achieve that, the thing is, it should be possible by default, so that I can simply say to e.g. my not-too-technical friend "this is my server, this is my cert, click there in your browser to compare the cert for my site before you connect and the browser will provably also not trust anybody else but your check." This should be a basically available scenario for the secure connection, just like what we have in SSH. Don't believe "the users are too stupid" excuse. It's just an excuse: https://golem.ph.utexas.edu/category/2014/10/new_evidence_of_nsa_weakening.html https://golem.ph.utexas.edu/category/2014/10/new_evidence_of... We simply shouldn't have to have the "trust in every crooked CA" when we connect to the servers we directly know.
- zaarn 9y ago
  If we get DNSSEC (or a less complicated alternative) working in widespread use then we could simply parse CAA records in the browser. That way a website owner can whitelist only a very specific CA for their certificates. Ideally with DNSSEC we could also get DANE and issue our own certificates and CA's would only be necessary as cosigner for OV, EV and similar.
  - acqq 9y ago
    The problem I describe and its easy solution are completely independent of DNSSEC.
    - zaarn 9y ago
      DNSSEC is required to secure DNS responses which can be crucial to prevent "every crooked CA" to issue a cert for you. If CAA was interpreted by the browser, you could determine exactly which CA is trusted to issue certs for your site and DNSSEC would ensure that the browser gets the correct list of trusted CAs.

by __jal 9y ago

acqq 9y ago

I know that it is possible to somehow achieve that, the thing is, it should be possible by default, so that I can simply say to e.g. my not-too-technical friend "this is my server, this is my cert, click there in your browser to compare the cert for my site before you connect and the browser will provably also not trust anybody else but your check." This should be a basically available scenario for the secure connection, just like what we have in SSH. Don't believe "the users are too stupid" excuse. It's just an excuse: https://golem.ph.utexas.edu/category/2014/10/new_evidence_of_nsa_weakening.html https://golem.ph.utexas.edu/category/2014/10/new_evidence_of... We simply shouldn't have to have the "trust in every crooked CA" when we connect to the servers we directly know.

zaarn 9y ago
If we get DNSSEC (or a less complicated alternative) working in widespread use then we could simply parse CAA records in the browser. That way a website owner can whitelist only a very specific CA for their certificates. Ideally with DNSSEC we could also get DANE and issue our own certificates and CA's would only be necessary as cosigner for OV, EV and similar.
- acqq 9y ago
  The problem I describe and its easy solution are completely independent of DNSSEC.
  - zaarn 9y ago
    DNSSEC is required to secure DNS responses which can be crucial to prevent "every crooked CA" to issue a cert for you. If CAA was interpreted by the browser, you could determine exactly which CA is trusted to issue certs for your site and DNSSEC would ensure that the browser gets the correct list of trusted CAs.