3 ms·
That would likely work for targeted attacks against browsers other than Chrome (and maybe recent FF, I'm not sure) but not for large scale dragnet attacks.
by marshray 13y ago
That would likely work for targeted attacks against browsers other than Chrome (and maybe recent FF, I'm not sure) but not for large scale dragnet attacks.
- reedlaw 13y agoWhy wouldn't it affect Chrome if the Root CA is trusted by Chrome? According to http://www.chromium.org/Home/chromium-security/root-ca-policy http://www.chromium.org/Home/chromium-security/root-ca-polic... they use the underlying OS list except in the case of Linux in which they use Mozilla's list.
- jmesserly 13y agoChrome has certificate pinning, see http://blog.chromium.org/2011/06/new-chromium-security-features-june.html http://blog.chromium.org/2011/06/new-chromium-security-featu...: "In addition in Chromium 13, only a very small subset of CAs have the authority to vouch for Gmail (and the Google Accounts login page). This can protect against recent incidents where a CA has its authority abused, and generally protects against the proliferation of signing authority." (disclaimer: I work for Chrome but not on these features.)