3 ms·

And now any security mishap with your CA compromises your entire browser because you can’t just trust a custom root certificate for “*.my stuff.com” without tru

And now any security mishap with your CA compromises your entire browser because you can’t just trust a custom root certificate for “*.my stuff.com” without trusting for mybank.com

CGamesPlay 4y ago
That’s a small phish to spear! And if the CA very is kept on local host, compromising it means you’ve already compromised my system.
jeroenhd 4y ago
If you're that much of a target, you'll find your devices hacked soon enough regardless. I can't speak about your threat model, but "exfiltrating my private CA keys to phish my browser" isn't really something I worry about in practice. For those still checking certificate validity, Firefox will warn you that the certificate used is not in the system database when you click the little lock in the address bar. That said, I'd absolutely love a system where I could restrict my private CA to certain domains.
- iso1210 4y ago
  You can use name constraints on the CA, but they are a bit hit and miss when it comes to client support. For a local CA with the CA only on one machine you're perhaps OK if you are careful, but once you share the server with a couple of collegues you are potentially into a world of hurt. On OSX you can choose "Always Trust" or "Never Trust" for various purposes (code signing, SSL, EAP, etc). Why can't I have "Ask first time", or "Trust only for specific domains" Same with built in ones. That "Hong Kong Post" root CA raises some eyebrows with me, I'd love to set that to "Ask first time" on it.
the8472 4y ago
Firefox appears to support[0] name constraints[1] in CA certificates. It even appears to have code that supports adding further constraints to the root certificates after they were imported, but that doesn't seem to be exposed anywhere in the UI. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=856060 https://bugzilla.mozilla.org/show_bug.cgi?id=856060 [1] https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1....
heretogetout 4y ago
I think you can mitigate this by deleting your CA key after signing a certificate for localhost. Sure, that means you can't sign new certificates, but that's not a big deal as you can just replace the CA on your desktop when the time comes.
dotancohen 4y ago
I do not recommend using the same browser for everyday web browsing and for development. For one thing, you don't want an adblocker or other content altering plugins on your dev browser. I like Firefox with Tree Style Tabs and an adblocker for everyday browsing, and some Chrome derivative with no addons other than Xdebug for development. Lately I've been using the Responsively browser for dev, especially if I need to do anything mobile.

And now any security mishap with your CA compromises your entire browser because you can’t just trust a custom root certificate for “*.my stuff.com” without trusting for mybank.com

CGamesPlay 4y ago

That’s a small phish to spear! And if the CA very is kept on local host, compromising it means you’ve already compromised my system.

jeroenhd 4y ago

If you're that much of a target, you'll find your devices hacked soon enough regardless. I can't speak about your threat model, but "exfiltrating my private CA keys to phish my browser" isn't really something I worry about in practice. For those still checking certificate validity, Firefox will warn you that the certificate used is not in the system database when you click the little lock in the address bar. That said, I'd absolutely love a system where I could restrict my private CA to certain domains.

iso1210 4y ago
You can use name constraints on the CA, but they are a bit hit and miss when it comes to client support. For a local CA with the CA only on one machine you're perhaps OK if you are careful, but once you share the server with a couple of collegues you are potentially into a world of hurt. On OSX you can choose "Always Trust" or "Never Trust" for various purposes (code signing, SSL, EAP, etc). Why can't I have "Ask first time", or "Trust only for specific domains" Same with built in ones. That "Hong Kong Post" root CA raises some eyebrows with me, I'd love to set that to "Ask first time" on it.

the8472 4y ago

Firefox appears to support[0] name constraints[1] in CA certificates. It even appears to have code that supports adding further constraints to the root certificates after they were imported, but that doesn't seem to be exposed anywhere in the UI. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=856060 https://bugzilla.mozilla.org/show_bug.cgi?id=856060 [1] https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1....

heretogetout 4y ago

I think you can mitigate this by deleting your CA key after signing a certificate for localhost. Sure, that means you can't sign new certificates, but that's not a big deal as you can just replace the CA on your desktop when the time comes.

dotancohen 4y ago

I do not recommend using the same browser for everyday web browsing and for development. For one thing, you don't want an adblocker or other content altering plugins on your dev browser. I like Firefox with Tree Style Tabs and an adblocker for everyday browsing, and some Chrome derivative with no addons other than Xdebug for development. Lately I've been using the Responsively browser for dev, especially if I need to do anything mobile.