3 ms·
Mozilla would kick Comcast out of the root CA list pretty fast. Finally, there is certificate transparency logs, you can set CT headers on your site to require
by jopsen 7y ago
Mozilla would kick Comcast out of the root CA list pretty fast.
Finally, there is certificate transparency logs, you can set CT headers on your site to require the certificate to be in CT logs.
Then you can monitor if anyone's creates certificates for your domain. And updated clients can validate that certificates is in the CT logs.
HTTPS is pretty robust these days. There's still a few corner cases around SNI, but that only leaks what host your visiting, wouldn't allow injection -- and specs are slowly closing those holes too.
- i2shar 7y agoIs there a published list of Root CA fingerprints a specific version of OS or browser is supposed to have that I can compare to? In other words, how can one tell if their browser/OS is not compromised with undesirable Root CAs.
- jopsen 7y agoMozilla maintains a list of root CAs that are distributed with Firefox, and used by most other vendors too. But really, if you don't trust what installed on your machine it's game over.