3 ms·

Also any of the many sites where content for different people is hosted under example.com/~username/content

by jpxw 6y ago

gspr 6y ago
Next step: an "education campaign" to tell people that that part of the web is "insecure". In fact you should only get any content from a handful of domains. And in non-net-neutrality jurisdictions, the ISPs will start offering packages that work with pre-approved domains only. And since it'll be enough for 90% people, it'll work. I hope I'm just being alarmist.
- vladvasiliu 6y ago
  This already kind of happens in Firefox. If you have a non public certificate authority, when you visit a site signed by that CA it says that it's not verified by an authority known to Firefox. I don't know if there is a way to "bless" such an authority once it's added to the trust store.
  - toyg 6y ago
    ? If it’s added to the trust store, it should be blessed. Note that this is the FF store, not the Windows one.
  - extra88 6y ago
    What browser doesn’t warn you about sites signed by a CA not in their list of CAs?
    - vladvasiliu 6y ago
      I specifically said "once it's added to the trust store". It is known to the browser. When I wrote the message I wasn't in front of Firefox, now I am. So to summarize: * The CA's certificate is added to the Firefox store and trusted. * Visiting a site gets the lock in the address bar. * Clicking on the lock in bar shows "Connection secure. Connection is verified by a certificate issuer that is not recognized by Mozilla" Screenshot: https://imgur.com/a/T4rznXK https://imgur.com/a/T4rznXK
      - extra88 6y ago
        So what’s the problem? Mozilla didn’t add the CA to the trust store, you did, that’s why Mozilla doesn’t recognize it. It doesn’t sound like it interferes with normal operation and differentiating bundled and added CAs on inspection sounds like a good idea.
  - gspr 6y ago
    This is a completely different matter.
onion2k 6y ago
That's technically correct, but as far as the security of the website is concerned example.com, example.com/~eviluser/uh-oh, and example.com/nefarious/sub/directory/pretending/to/be/google.com/ are all exactly the same. The issue Google are trying to "fix" is making it more clear that the domain the user sees is what they're really looking for. If a user on a website is being evil it's up to the website owner to stop that, not Google. Google are trying to protect people against evil website owners (or so they say...).

Also any of the many sites where content for different people is hosted under example.com/~username/content

by jpxw 6y ago

Also any of the many sites where content for different people is hosted under example.com/~username/content

gspr 6y ago

Next step: an "education campaign" to tell people that that part of the web is "insecure". In fact you should only get any content from a handful of domains. And in non-net-neutrality jurisdictions, the ISPs will start offering packages that work with pre-approved domains only. And since it'll be enough for 90% people, it'll work. I hope I'm just being alarmist.

vladvasiliu 6y ago
This already kind of happens in Firefox. If you have a non public certificate authority, when you visit a site signed by that CA it says that it's not verified by an authority known to Firefox. I don't know if there is a way to "bless" such an authority once it's added to the trust store.
- toyg 6y ago
  ? If it’s added to the trust store, it should be blessed. Note that this is the FF store, not the Windows one.
- extra88 6y ago
  What browser doesn’t warn you about sites signed by a CA not in their list of CAs?
  - vladvasiliu 6y ago
    I specifically said "once it's added to the trust store". It is known to the browser. When I wrote the message I wasn't in front of Firefox, now I am. So to summarize: * The CA's certificate is added to the Firefox store and trusted. * Visiting a site gets the lock in the address bar. * Clicking on the lock in bar shows "Connection secure. Connection is verified by a certificate issuer that is not recognized by Mozilla" Screenshot: https://imgur.com/a/T4rznXK https://imgur.com/a/T4rznXK
    - extra88 6y ago
      So what’s the problem? Mozilla didn’t add the CA to the trust store, you did, that’s why Mozilla doesn’t recognize it. It doesn’t sound like it interferes with normal operation and differentiating bundled and added CAs on inspection sounds like a good idea.
- gspr 6y ago
  This is a completely different matter.

onion2k 6y ago

That's technically correct, but as far as the security of the website is concerned example.com, example.com/~eviluser/uh-oh, and example.com/nefarious/sub/directory/pretending/to/be/google.com/ are all exactly the same. The issue Google are trying to "fix" is making it more clear that the domain the user sees is what they're really looking for. If a user on a website is being evil it's up to the website owner to stop that, not Google. Google are trying to protect people against evil website owners (or so they say...).