Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Certificate Transparency in Firefox

blog.transparency.dev

Post reply on HN
Print view View original

11–20 of 116 posts

Re: Certificate Transparency in Firefox

#13

Post by lambdaone »

ozim wrote: post #9

Wonder why they say you should monitor transparency logs instead of setting up CAA records - malicious actors will most likely disregard CAA anyway.

Let's not let the best be the enemy of the good. Malicious actors who disregard CAA would first have to have gone through the process of accreditation to be added to public trust stores, and then would quickly get removed from those trust stores as soon as the imposture was detected. So while creating a malicious CA and then ignoring CAA records is entirely possible for few-shot high-value attacks, it's not a scalable approach, and it means CAA offers at least partial protection against malicious actors forging certificates as a day-to-day activity.

Transparency logs are of course better because they make it much easier for rogue CAs to be caught rapidly, but it's not a reason to abandon CAA until transparency log checking is universal, not just in browsers, but across the whole PKI ecosystem.

Re: Certificate Transparency in Firefox

#15

Post by notpushkin »

q2dg wrote: post #10
perching_aix wrote: post #6

Earlier quoted context omitted.

CT is an append-only distributed log for certificate issuances. People and client software can use it to check if a certificate is being provided by a trusted CA, if it has been revoked, or is being provided by multiple CAs (the latter possibly indicating CA compromise). CA meaning Certificate Authority, the organizations that issue certificates. This provides a further layer of technological defense to attempting th…

Will Mitmproxy stop working?

Chrome treats certificates added by user as not requiring CT: https://github.com/mitmproxy/mitmproxy/discussions/5720

Re: Certificate Transparency in Firefox

#16

Post by perching_aix »

q2dg wrote: post #10
perching_aix wrote: post #6

Earlier quoted context omitted.

CT is an append-only distributed log for certificate issuances. People and client software can use it to check if a certificate is being provided by a trusted CA, if it has been revoked, or is being provided by multiple CAs (the latter possibly indicating CA compromise). CA meaning Certificate Authority, the organizations that issue certificates. This provides a further layer of technological defense to attempting th…

Will Mitmproxy stop working?

I believe so. You'll need to disable CT enforcement / or add your SPKI hash to the ignore list in the browser settings temporarily to get it working. [0] I guess this is also how corporations get around this issue? Still unsure.

[0] https://wiki.mozilla.org/SecurityEngineering/Certificate_Tra...

Re: Certificate Transparency in Firefox

#18

Post by zinekeller »

megamorf wrote: post #14

Doesn't this effectively render corporate CAs useless?

> Doesn't this effectively render corporate CAs useless?

All of the browsers ignore transparency for enterprise roots. To determine which is which, the list of actual public roots is stored separately in the CA database, listed in chrome://certificate-manager/crscerts for Chrome and listed as a "Builtin Object Token" in Firefox's Certificate Manager.

Re: Certificate Transparency in Firefox

#20

Post by archi42 »

megamorf wrote: post #14

Doesn't this effectively render corporate CAs useless?

Another comment mentioned [0]. Enterprise and people running a private CA can set "security.pki.certificate_transparency.disable_for_hosts" to disable CT for certain domains (plus all their subdomains).

I just hope they automatically disable it for non-public tlds, both from IANA and RFC 6762.

[0] https://wiki.mozilla.org/SecurityEngineering/Certificate_Tra...

Post reply on HN