4 ms·

> Certificate issuance transparency helps, but doesn't get rid of the fundamental issue. I think the real innovation in transparency will be client side. I hav

> Certificate issuance transparency helps, but doesn't get rid of the fundamental issue. I think the real innovation in transparency will be client side. I have been wanting to develop a "root CA" hit counter that tracked locally which of the sites you visit used which CA. You could say the logical addition from there is to allow users to disable unused CAs (or do it automatically when unused) and have a opt-in when a disabled one is used, but I think that's too much. Just a client-side plugin to let me see which CA is used and keep track alongside history (i.e. not in incognito) would be nice. I am waiting for this Chromium issue to implement such a thing: https://bugs.chromium.org/p/chromium/issues/detail?id=628819 https://bugs.chromium.org/p/chromium/issues/detail?id=628819 (looks already done in FF)

tialaramex 7y ago
Yes, the Firefox plug-in "Certainly Something" uses the equivalent APIs in Firefox and works today, giving back a nicer version of their old "View certificate" UI only to the fraction of people who care, rather than weighing down the actual Firefox browser with more and more X.509 features most users will never need. You probably should not encourage lay users to disable CAs they aren't using, it's like those plastic "child safety" plug inserts in the UK - kids already can't actually do the thing the insert pretends to prevent, safety shutters mandated by law in your power sockets keep tiny fingers out of the live power - but the plastic insert is exactly the perfect shape for a kid to defeat the safety protection and electrocute themselves.
- saber6 7y ago
  > You probably should not encourage lay users to disable CAs they aren't using, it's like those plastic "child safety" plug inserts in the UK - kids already can't actually do the thing the insert pretends to prevent, safety shutters mandated by law in your power sockets keep tiny fingers out of the live power - but the plastic insert is exactly the perfect shape for a kid to defeat the safety protection and electrocute themselves. Your analogy is unnecessary. This is simply a case of determining which issuing authorities you want to trust. Do I want to trust ones in China? No. That's not racist by the way.
- evilpie 7y ago
  Since Firefox 72, the built-in certificate viewer actual reuses most of the JavaScript code from "Certainly Something". So the extension isn't strictly necessary anymore.
  - tialaramex 7y ago
    Huh. I hadn't looked until now but you are 100% correct. What a strange choice.

tialaramex 7y ago

Yes, the Firefox plug-in "Certainly Something" uses the equivalent APIs in Firefox and works today, giving back a nicer version of their old "View certificate" UI only to the fraction of people who care, rather than weighing down the actual Firefox browser with more and more X.509 features most users will never need. You probably should not encourage lay users to disable CAs they aren't using, it's like those plastic "child safety" plug inserts in the UK - kids already can't actually do the thing the insert pretends to prevent, safety shutters mandated by law in your power sockets keep tiny fingers out of the live power - but the plastic insert is exactly the perfect shape for a kid to defeat the safety protection and electrocute themselves.

saber6 7y ago
> You probably should not encourage lay users to disable CAs they aren't using, it's like those plastic "child safety" plug inserts in the UK - kids already can't actually do the thing the insert pretends to prevent, safety shutters mandated by law in your power sockets keep tiny fingers out of the live power - but the plastic insert is exactly the perfect shape for a kid to defeat the safety protection and electrocute themselves. Your analogy is unnecessary. This is simply a case of determining which issuing authorities you want to trust. Do I want to trust ones in China? No. That's not racist by the way.
evilpie 7y ago
Since Firefox 72, the built-in certificate viewer actual reuses most of the JavaScript code from "Certainly Something". So the extension isn't strictly necessary anymore.
- tialaramex 7y ago
  Huh. I hadn't looked until now but you are 100% correct. What a strange choice.