Show HN: Sslhash: SSL without a certificate authority
1–10 of 13 posts
Re: Show HN: Sslhash: SSL without a certificate authority
#2How does expiration work? What happens if an TLS/SSL cert is leaked/compromised? Change the clients as well?
Re: Show HN: Sslhash: SSL without a certificate authority
#3How does expiration work? What happens if an TLS/SSL cert is leaked/compromised? Change the clients as well?
You would probably need some sort of "authority" to redistribute the hashes.
Re: Show HN: Sslhash: SSL without a certificate authority
#4I’m confused, domains are not a barrier to entry (I’d argue that the developer account is a much larger barrier). Why is this a needed thing?
Re: Show HN: Sslhash: SSL without a certificate authority
#5I’m confused, domains are not a barrier to entry (I’d argue that the developer account is a much larger barrier). Why is this a needed thing?
Not sure what you mean by developer account...
Anyway, if I understand correctly, this is basically just a user friendly version of certificate pinning.
Re: Show HN: Sslhash: SSL without a certificate authority
#6How does expiration work? What happens if an TLS/SSL cert is leaked/compromised? Change the clients as well?
Pretty much same story as SSH keys and fingerprints.
Re: Show HN: Sslhash: SSL without a certificate authority
#7I’m confused, domains are not a barrier to entry (I’d argue that the developer account is a much larger barrier). Why is this a needed thing?
Not sure what you mean by developer account... Anyway, if I understand correctly, this is basically just a user friendly version of certificate pinning.
Oops! For some reason I thought it was Swift at first. My bad, I understand it a bit better now then :).
Re: Show HN: Sslhash: SSL without a certificate authority
#8How does expiration work? What happens if an TLS/SSL cert is leaked/compromised? Change the clients as well?
You would probably need some sort of "authority" to redistribute the hashes.
The was / is a DNS standard for that: DANE. Sadly DANE was never really adopted. Chrome had support for it but it was removed eventually.
Re: Show HN: Sslhash: SSL without a certificate authority
#9Rather pointless to compare the SSL certificate to a hash ofcourse. Why not just compare it to a copy of the certificate. No need to obfuscate and allow user to be fooled with changed hash.
Re: Show HN: Sslhash: SSL without a certificate authority
#10How does expiration work? What happens if an TLS/SSL cert is leaked/compromised? Change the clients as well?
You would probably need some sort of "authority" to redistribute the hashes.
One of the main reasons for the library is no need for cert authority. Why not just create a regular cert Authority certificate and put the trusted authority cert on the clients. That makes it so you almost never have to change the clients certs. Also, it's supported by standard TLS libraries and clients.