4 ms·

Be great if you could open your certificate store, look through the list of roots, and see how often you have used each one, and a list of sites they have appro

Be great if you could open your certificate store, look through the list of roots, and see how often you have used each one, and a list of sites they have approved. Then you could say "hmm, these I've never used -- set it to manual approval for each site they try to authenticate" Or "For this one, that's great, I'll use it to authenticate .ae domains, but nothing more, or I'll allow .bankofchina.com, but nothing more" Would only apply for 0.001% of browser users though, and they are the ones who are more likely to push for a better solution which will apply to the rest of the world, so I can see why they don't want that.

tgsovlerkhgsel 4y ago
Certificate Transparency is even better, it allows you to see all certificates these CAs issued. This also means the site operator can monitor for certificates issued for their site and notice if a CA they aren't using issues one. Unfortunately, Firefox doesn't seem to enforce CT https://developer.mozilla.org/en-US/docs/Web/Security/Certificate_Transparency https://developer.mozilla.org/en-US/docs/Web/Security/Certif...
- frankjr 4y ago
  > Certificate Transparency is even better, it allows you to see all certificates these CAs issued. What OP suggested would potentially prevented a rogue behavior from a hacked CA to cause any damage. With Certificate Transparency you would just have a nice log about it afterwards. > This also means the site operator can monitor for certificates issued for their site and notice if a CA they aren't using issues one. All they could do is to just turn off the site and report the incident. It would still take hours before that certificate would be revoked and that information propagated to browsers. I'm also fairly confident 99.5% of website operators do not watch any cert monitors.
  - bawolff 4y ago
    > With Certificate Transparency you would just have a nice log about it afterwards. Fear of consequences is a powerful thing. A rouge cert issue basically kills the CA.
    - computerfriend 4y ago
      Yeah, but in some cases it's worth it.
- iso1631 4y ago
  Why is that? The link in the section explaining it doesn't isn't very helpful

tgsovlerkhgsel 4y ago

Certificate Transparency is even better, it allows you to see all certificates these CAs issued. This also means the site operator can monitor for certificates issued for their site and notice if a CA they aren't using issues one. Unfortunately, Firefox doesn't seem to enforce CT https://developer.mozilla.org/en-US/docs/Web/Security/Certificate_Transparency https://developer.mozilla.org/en-US/docs/Web/Security/Certif...

frankjr 4y ago
> Certificate Transparency is even better, it allows you to see all certificates these CAs issued. What OP suggested would potentially prevented a rogue behavior from a hacked CA to cause any damage. With Certificate Transparency you would just have a nice log about it afterwards. > This also means the site operator can monitor for certificates issued for their site and notice if a CA they aren't using issues one. All they could do is to just turn off the site and report the incident. It would still take hours before that certificate would be revoked and that information propagated to browsers. I'm also fairly confident 99.5% of website operators do not watch any cert monitors.
- bawolff 4y ago
  > With Certificate Transparency you would just have a nice log about it afterwards. Fear of consequences is a powerful thing. A rouge cert issue basically kills the CA.
  - computerfriend 4y ago
    Yeah, but in some cases it's worth it.
iso1631 4y ago
Why is that? The link in the section explaining it doesn't isn't very helpful