4 ms·
This looks like the next iteration of Moxie Marlinspike's Convergence[1] project. For anyone who doesn't understand why SSL for browsers as deployed is broken,
by casca 14y ago
This looks like the next iteration of Moxie Marlinspike's Convergence[1] project.
For anyone who doesn't understand why SSL for browsers as deployed is broken, a quick exercise is to look at how many CA certificates come trusted with your favourite browser. For example, Firefox trusts the "Hongkong Post Root CA". This means that anyone who has access to the signing key can claim to be any SSL site. So they could issue a certificate for www.gmail.com which would allow someone to transparently intercept all your traffic.
Certificate Pinning is a very good start to somewhat mitigate this.
[1] http://convergence.io/details.html http://convergence.io/details.html
- NateLawson 14y agoTACK benefits from Convergence, but isn't based on it. It also doesn't require it. Convergence could be used as a source of information on existing pins it has seen, but TACK is still useful even if it's just supplied by the website itself. Think of it like ssh known-hosts, but with the added feature that the server side (sshd) can securely tell you to stop using an old entry in known-hosts and use a new one instead when its server key changes. Also, TACK is not certificate pinning. It's public-key pinning (the thing inside the cert). You can change certs all you want without changing the public key, and the same TACK pin will be valid for all of them. This is better than cert pinning since you can change CAs without having to redo all your cert pins.