5 ms·

yes, and a rouge CA can sign a certificate for any site, and HTTPS in it's current state might not defend from it. (Though I think some browsers now check the p

yes, and a rouge CA can sign a certificate for any site, and HTTPS in it's current state might not defend from it. (Though I think some browsers now check the presence of the Certificate Issuance in the CT logs, as a additional security measure) Such a attack would immediately end up with the relevant CA being removed from the certificate stores across popular browsers/OS, quite detrimental to the business who owns them. This does not mean that HTTPS doesn't provide security, compared to plain-text, it is a significantly harder to game it, verging on the edge of infeasible.

JPLeRouzic 4y ago
> Such a attack would immediately end up with the relevant CA being removed from the certificate stores across popular browsers/OS, quite detrimental to the business who owns them. Absolutely, but when I look at the list of CAs (~70) that are preloaded in browsers: * Most of them are unknown to most people => How to know if there is no malevolent CAs? * A relevant number are from countries that are not so free. => What power has a SME like Firefox against let's say Turkey, Hungary or China states?
- Anunayj 4y ago
  > How to know if there is no malevolent CAs CT logs make issuance of certificates very public, that allows the community to react to mis-issued certificates very quickly, this however doesn't stop a CA from just not submitting the cert to CT logs. Browsers like Google Chrome check the certificate in CT logs, and would refuse to work otherwise.
- tengwar2 4y ago
  Unless you need to deal with companies that use certificates from countries that you do not trust, why not just delete/distrust them? The organisation behind Firefox is the Mozilla Corporation, which is owned by the Mozilla Foundation. It's not particularly easy to find out what its legal status is, but that probably doesn't matter. It is not obliged to carry anyone's root certificates. There would be a market share cost for not doing so, but that's it.

JPLeRouzic 4y ago

> Such a attack would immediately end up with the relevant CA being removed from the certificate stores across popular browsers/OS, quite detrimental to the business who owns them. Absolutely, but when I look at the list of CAs (~70) that are preloaded in browsers: * Most of them are unknown to most people => How to know if there is no malevolent CAs? * A relevant number are from countries that are not so free. => What power has a SME like Firefox against let's say Turkey, Hungary or China states?

Anunayj 4y ago
> How to know if there is no malevolent CAs CT logs make issuance of certificates very public, that allows the community to react to mis-issued certificates very quickly, this however doesn't stop a CA from just not submitting the cert to CT logs. Browsers like Google Chrome check the certificate in CT logs, and would refuse to work otherwise.
tengwar2 4y ago
Unless you need to deal with companies that use certificates from countries that you do not trust, why not just delete/distrust them? The organisation behind Firefox is the Mozilla Corporation, which is owned by the Mozilla Foundation. It's not particularly easy to find out what its legal status is, but that probably doesn't matter. It is not obliged to carry anyone's root certificates. There would be a market share cost for not doing so, but that's it.