5 ms·

Would anyone be interested in a site that lets you see who signed the web server's cert from different points on the Internet? Sort of like IsItUp.com but for M

Would anyone be interested in a site that lets you see who signed the web server's cert from different points on the Internet? Sort of like IsItUp.com but for MITM.

dijit 12y ago
Convergence by Moxie Marlinspike does that. doesn't work terribly well in practice though. http://convergence.io/ http://convergence.io/
- IgorPartola 12y ago
  Out of curiosity, why doesn't it work?
  - dijit 12y ago
    massive latency mostly. although there are a lot of issues[0] on it's github page which seem to be unaddressed. [0] - https://github.com/moxie0/Convergence/issues https://github.com/moxie0/Convergence/issues
toomuchtodo 12y ago
https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm
- PhantomGremlin 12y ago
  That's a very good explanation of the general state of affairs. But in my experience trying the Certificate Patrol add-on for Firefox for a few months, the ideal of "the authentic site's fingerprint" doesn't exist for big sites. It works for small sites like grc.com, but larger sites constantly present a variety of certificates. That variety seems to change every few days. Also certificate expiration times frequently change. Gibson does acknowledge "False-Positive Mismatches" but in my experience this is a big big problem that makes the single "fingerprint" idea almost useless. A smart add-on would eliminate a lot of these false positives. E.g. if your browser has already stored a certificate for a site and the new certificate is issued by the same CA to the same entity and the only difference is a new expiration date, why not silently accept the new one, while still remembering the old expiration? That's a risk I'd be willing to take. Same thing for multiple certificates from different issuers. I want to be warned only the first time a certificate is encountered. If the same one is encountered again next week or next month, then that's another "false-positive mismatch" that should be silently suppressed. And, realistically, why does there need to be an add-on? Mozilla gets something like $300 million per year in funding. What are they doing with all that money, if Firefox is still so vulnerable to this nonsense?
  - toomuchtodo 12y ago
    I think it would also be valuable if sites would also publish their SSL certificate fingerprints out of band, perhaps through DNS TXT records, for verification.
    - IgorPartola 12y ago
      Or via HTTP. Why bother with DNS? Just put them at /certs.txt and serve them over HTTP. It would be equally as secure as serving them over DNS, that is not at all.
      - toomuchtodo 12y ago
        HTTP is insecure and could be MITM. And HTTPS is no good as you don't know if you can trust the cert, as you couldn't get the fingerprints before connecting. DNSSEC is secure.
        IgorPartola 12y ago
        Yet, DNSSEC introduces a huge number of other problems like giving government agents even more control over the Internet. I was strongly in the DNSSEC camp until doing more research into it. I'd summon @tptacek for this discussion, but I think you've actually participated in a few of those already with him.
PhantomGremlin 12y ago
Certificate Patrol should also be sufficient. However, it's implemented very poorly. It should remember all certificates previously served by a site and only show you new ones. But it's constantly warning about changes that are false positives. There is a real need for software that makes this "just work".

Would anyone be interested in a site that lets you see who signed the web server's cert from different points on the Internet? Sort of like IsItUp.com but for MITM.

dijit 12y ago

Convergence by Moxie Marlinspike does that. doesn't work terribly well in practice though. http://convergence.io/ http://convergence.io/

IgorPartola 12y ago
Out of curiosity, why doesn't it work?
- dijit 12y ago
  massive latency mostly. although there are a lot of issues[0] on it's github page which seem to be unaddressed. [0] - https://github.com/moxie0/Convergence/issues https://github.com/moxie0/Convergence/issues

toomuchtodo 12y ago

https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm

PhantomGremlin 12y ago
That's a very good explanation of the general state of affairs. But in my experience trying the Certificate Patrol add-on for Firefox for a few months, the ideal of "the authentic site's fingerprint" doesn't exist for big sites. It works for small sites like grc.com, but larger sites constantly present a variety of certificates. That variety seems to change every few days. Also certificate expiration times frequently change. Gibson does acknowledge "False-Positive Mismatches" but in my experience this is a big big problem that makes the single "fingerprint" idea almost useless. A smart add-on would eliminate a lot of these false positives. E.g. if your browser has already stored a certificate for a site and the new certificate is issued by the same CA to the same entity and the only difference is a new expiration date, why not silently accept the new one, while still remembering the old expiration? That's a risk I'd be willing to take. Same thing for multiple certificates from different issuers. I want to be warned only the first time a certificate is encountered. If the same one is encountered again next week or next month, then that's another "false-positive mismatch" that should be silently suppressed. And, realistically, why does there need to be an add-on? Mozilla gets something like $300 million per year in funding. What are they doing with all that money, if Firefox is still so vulnerable to this nonsense?
- toomuchtodo 12y ago
  I think it would also be valuable if sites would also publish their SSL certificate fingerprints out of band, perhaps through DNS TXT records, for verification.
  - IgorPartola 12y ago
    Or via HTTP. Why bother with DNS? Just put them at /certs.txt and serve them over HTTP. It would be equally as secure as serving them over DNS, that is not at all.
    - toomuchtodo 12y ago
      HTTP is insecure and could be MITM. And HTTPS is no good as you don't know if you can trust the cert, as you couldn't get the fingerprints before connecting. DNSSEC is secure.
      - IgorPartola 12y ago
        Yet, DNSSEC introduces a huge number of other problems like giving government agents even more control over the Internet. I was strongly in the DNSSEC camp until doing more research into it. I'd summon @tptacek for this discussion, but I think you've actually participated in a few of those already with him.

PhantomGremlin 12y ago

Certificate Patrol should also be sufficient. However, it's implemented very poorly. It should remember all certificates previously served by a site and only show you new ones. But it's constantly warning about changes that are false positives. There is a real need for software that makes this "just work".