4 ms·
It doesn't require that at all. You could simply strip the SSL and present a HTTP version of the page, and most people would be none the wiser. Or you could red
by thirsteh 13y ago
It doesn't require that at all. You could simply strip the SSL and present a HTTP version of the page, and most people would be none the wiser. Or you could redirect to e.g. www.facebook23.com and have them log in there, with a nice little padlock. At no point would they get a certificate warning. They wouldn't get a certificate warning if you had compromised one of those 650+ CAs either, unless the site in question used certificate pinning (almost no sites do, currently.)
- e12e 13y ago> ... unless the site in question used certificate pinning (almost no sites do, currently.) Is there any semi-standard way to do pinning? That is/will be supported by at least the next (preferably current) version of the major browsers? Or do you mean "manual" pinning (eg: convergence et al)? I'm no aware of anything a site administrator can do to unilaterally enable/force certificate pinning? The best I could find was: https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning but as far as I can see (skimming) -- there's nothing there about standard software doing pinning -- it's all about when you're deploying (part of) the client as well?
- thirsteh 13y agoChrome supports public-key pinning via HTTP responses: https://code.google.com/p/chromium/issues/detail?id=78369 https://code.google.com/p/chromium/issues/detail?id=78369. I'm not sure about the other browsers. https://tools.ietf.org/html/draft-ietf-websec-key-pinning-06#section-2.3.1 https://tools.ietf.org/html/draft-ietf-websec-key-pinning-06...
- e12e 13y agoThank you for the links - exactly the kind of thing I was looking for :-)