5 ms·

It seems like we should have something like known_hosts for ssh, yeah. As long as it’s trusting one domain at a time (not a root CA), would it really be /that/

It seems like we should have something like known_hosts for ssh, yeah. As long as it’s trusting one domain at a time (not a root CA), would it really be /that/ bad? This and browser vendors being overbearing about extensions (I know they’re powerful) gets me down.

wjrtyjw 6y ago
Isn't this the default behavior of most browsers? Access an https service with an untrusted tls certificate, the browser throws a warning and offers a way to permanently trust the certificate.
- somehnguy 6y ago
  Neither Chrome nor Edge offer a simple way to permanently trust the cert. I’m sure there is a way to do it but they don’t make it obvious. It’s maddening as someone who develops and distributes local network apps with https.
  - gpas 6y ago
    I'm on chromium right now and it does remember my decision to trust self signed cert once I click proceed to unsafe domain the first time. It's not ideal, and it shows an alert to inform the user of the fake certificate, but it works and unlocks the https only APIs on a local offline environment. It's permanent until you switch user profile or click on the alert on the left of the address bar and reenable the warnings for that domain.
  - oarsinsync 6y ago
    Sounds like you're using Windows, and I believe both ultimately outsource that to the OS, so you'd need to look whereever windows manages certificate trust to find and remove any old trusted certs. HTH.
- WanderPanda 6y ago
  I am actually glad that they don’t permanently trust it like I belief Safari does it. Accepting invalid certificates in Safari always freaks me out
- labawi 6y ago
  If I click accept/trust, what does the browser actually do? Surely, it won't start trusting the certificate as it is (a self-signed wildcard or CA cert would get blanket MITM capability).
freeone3000 6y ago
Known_hosts works by having a list of trusted public keys. The TLS equivalent is adding the endpoint's TLS cert to your local trust store.
- labawi 6y ago
  That's not equivalent and easily dangerous. Random server's TLS cert could be a wildcard or even a CA, which you should not add to your trust store with a single click. The certificate needs to be either restricted to specific domains (preferable) or validated to make sure there aren't any suspicious attributes (seems easy to get wrong or reject many certificates).
heavyset_go 6y ago
You used to be able to add your own certificates to a device's certificate store. Nonadjustable certificate stores complement planned obsolescence, and help split the market into consumer and enterprise devices, that latter of which you can charge a premium for.
- jefftk 6y ago
  Firefox has its own store, and you can add certs: https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox https://support.mozilla.org/en-US/kb/setting-certificate-aut... Chrome uses the OS store (for now: https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...) which you can also add certs to.
  - heavyset_go 6y ago
    I can't do that with my Chromecast, though, which my point. There are devices that depend on HTTPS to function, but are designed such that the user who owns the device cannot add their own certificates to their trust store.
    - midasuni 6y ago
      A consequence of running software you don’t control. They all laughed at Stallman
MaxBarraclough 6y ago
> As long as it’s trusting one domain at a time (not a root CA), would it really be /that/ bad? I think the unhappy reality is that yes, it would. In security terms it's a good thing the major browsers are extremely hostile to invalid HTTPS certs, and do not give the user an easy way to proceed (as somehnguy mentioned). If you give the average user a simple Click to proceed, they will use it unthinkingly. Then, an invalid cert would no longer be a website-breaking catastrophe (which it absolutely should be), instead it would just be a strange pop-up that the user quickly forgets about, and the door is opened to bypassing the whole system of certificate-based security. If you have the technical know-how, you already have the ability to customise the set of trusted certificates on your machine (with the possible exception of 'locked-down' mobile systems like iOS). The rest is a matter of UI. > This and browser vendors being overbearing about extensions (I know they’re powerful) gets me down. Similar situation. Unless carefully policed, browser extension stores can be used as attack vectors, and whether it's fair or not, the browser gets a bad reputation.

wjrtyjw 6y ago

Isn't this the default behavior of most browsers? Access an https service with an untrusted tls certificate, the browser throws a warning and offers a way to permanently trust the certificate.

somehnguy 6y ago
Neither Chrome nor Edge offer a simple way to permanently trust the cert. I’m sure there is a way to do it but they don’t make it obvious. It’s maddening as someone who develops and distributes local network apps with https.
- gpas 6y ago
  I'm on chromium right now and it does remember my decision to trust self signed cert once I click proceed to unsafe domain the first time. It's not ideal, and it shows an alert to inform the user of the fake certificate, but it works and unlocks the https only APIs on a local offline environment. It's permanent until you switch user profile or click on the alert on the left of the address bar and reenable the warnings for that domain.
- oarsinsync 6y ago
  Sounds like you're using Windows, and I believe both ultimately outsource that to the OS, so you'd need to look whereever windows manages certificate trust to find and remove any old trusted certs. HTH.
WanderPanda 6y ago
I am actually glad that they don’t permanently trust it like I belief Safari does it. Accepting invalid certificates in Safari always freaks me out
labawi 6y ago
If I click accept/trust, what does the browser actually do? Surely, it won't start trusting the certificate as it is (a self-signed wildcard or CA cert would get blanket MITM capability).

freeone3000 6y ago

Known_hosts works by having a list of trusted public keys. The TLS equivalent is adding the endpoint's TLS cert to your local trust store.

labawi 6y ago
That's not equivalent and easily dangerous. Random server's TLS cert could be a wildcard or even a CA, which you should not add to your trust store with a single click. The certificate needs to be either restricted to specific domains (preferable) or validated to make sure there aren't any suspicious attributes (seems easy to get wrong or reject many certificates).

heavyset_go 6y ago

You used to be able to add your own certificates to a device's certificate store. Nonadjustable certificate stores complement planned obsolescence, and help split the market into consumer and enterprise devices, that latter of which you can charge a premium for.

jefftk 6y ago
Firefox has its own store, and you can add certs: https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox https://support.mozilla.org/en-US/kb/setting-certificate-aut... Chrome uses the OS store (for now: https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...) which you can also add certs to.
- heavyset_go 6y ago
  I can't do that with my Chromecast, though, which my point. There are devices that depend on HTTPS to function, but are designed such that the user who owns the device cannot add their own certificates to their trust store.
  - midasuni 6y ago
    A consequence of running software you don’t control. They all laughed at Stallman

MaxBarraclough 6y ago

> As long as it’s trusting one domain at a time (not a root CA), would it really be /that/ bad? I think the unhappy reality is that yes, it would. In security terms it's a good thing the major browsers are extremely hostile to invalid HTTPS certs, and do not give the user an easy way to proceed (as somehnguy mentioned). If you give the average user a simple Click to proceed, they will use it unthinkingly. Then, an invalid cert would no longer be a website-breaking catastrophe (which it absolutely should be), instead it would just be a strange pop-up that the user quickly forgets about, and the door is opened to bypassing the whole system of certificate-based security. If you have the technical know-how, you already have the ability to customise the set of trusted certificates on your machine (with the possible exception of 'locked-down' mobile systems like iOS). The rest is a matter of UI. > This and browser vendors being overbearing about extensions (I know they’re powerful) gets me down. Similar situation. Unless carefully policed, browser extension stores can be used as attack vectors, and whether it's fair or not, the browser gets a bad reputation.