5 ms·
What if you don't trust any certificate providers?
by enriquto 5y ago
What if you don't trust any certificate providers?
- dijit 5y agoOne of the major issues with web PKI is that any root certificate authority can sign any domain. For Google this is fixed by hard coding the SSL hashes into chrome, for the rest of us we rely on http headers; which of course are much more fungible.
- TingPing 5y agoThe CAA dns type indicates which CAs are allowed to sign for a domain.
- dijit 5y agoIf you’re in the middle; this is the most trivial thing in the world to block; in fact the CAA dns record is so limited in what it protects against that I’m genuinely confused as to why it exists. Maybe with DoH it’s better. But that’s more https to make https not suck.
- solraph 5y agoFrom the linked article. > Use CAA records[0] to restrict which CAs can issue certificates for your site. Disclaimer, I didn't know about them either. TIL. [0] https://datatracker.ietf.org/doc/html/rfc6844 https://datatracker.ietf.org/doc/html/rfc6844
- mhitza 5y agoYou really can't, and there's no easy way to selectively trust some. For example, one time I went through the huge list of certificate providers in Firefox and manually disabled a bunch of countries and only left in a few major providers I heard the name of before. My day to day browsing worked just fine, with no noticeable impact, but it was not something I can manage on a regular and just a one-off experiment.
- adgjlsfhk1 5y agoIf you're using HTTP, you are trusting them not to MITM your website already.
- enriquto 5y agoYes, so what's the difference?
- adgjlsfhk1 5y agoWith HTTPS you aren't also trusting literally everyone else on the internet to not mess with you.
- remram 5y agoTrust them to do what? Trust them with what?
- mburee 5y agoTo not sign malicious agents so they can act like they're the website you're actually trying connect to. There's a worryingly large amount of CA in Firefox or other browsers, many of the quite shady or government-owned
- remram 5y agoThis can happen regardless of whether you set up a certificate yourself. If you're using plain HTTP, someone can MITM in HTTP, and a rogue authority can issue a certificate to someone who isn't you. This is not an argument against you using HTTPS at all.
- enriquto 5y agoSo, you are admitting that HTTP and HTTPS are both equally insecure (they can be blocked or falsely approved by malicious authorities/service providers). At least, plain HTTP seems harder to censor: you do not need anybody's permission to transfer HTTP. Self-signed HTTPS would be even better, but it seems to be frowned-upon by browsers these days.
- remram 5y ago> you are admitting that HTTP and HTTPS are both equally insecure Absolutely not. I am pointing out that even within your (incorrect) assumption, you using HTTPS does not hurt your security at all. That you take it to mean "HTTPS is insecure" is your own assumption, that you take it to mean "equally as insecure as HTTP" is something you made up. A parallel: A lot of companies make seatbelts, you're not sure you can trust all of them. Even though they would be caught by quality testing and instantly go under, it is possible that one of them would build them with cheap materials that wouldn't offer much protection. Therefore seatbelts are not completely safe. Therefore wearing a seatbelt is equally as safe as not wearing one.
- dreamsbythelake 5y agoTor onion service? Unfortunately, self-signed cert. will terrify most visitors when browser will start screaming red and yellow on them ...