Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Certificate Transparency in Firefox

blog.transparency.dev

Post reply on HN
Print view View original

51–60 of 116 posts

Re: Certificate Transparency in Firefox

#51

Post by perching_aix »

greatgib wrote: post #34

In theory it is good, but somehow it is also a big threat to privacy and security of your infrastructure. No need anymore to scan your network to map the complete endpoints of your infrastructure! And it's a new single point of control and failure!

It does leak domain name info, but then you do still have the option to use a wildcard certificate or set up a private CA instead of relying on public ones, which likely makes more sense when dealing with a private resource anyways.

I guess there might be a scenario where you need "secret" domains be publicly resolvable and use distinct certs, but an example escapes me.

Re: Certificate Transparency in Firefox

#52

Post by cle »

Eikon wrote: post #35
greatgib wrote: post #34

In theory it is good, but somehow it is also a big threat to privacy and security of your infrastructure. No need anymore to scan your network to map the complete endpoints of your infrastructure! And it's a new single point of control and failure!

You're essentially advocating for security through obscurity. The fact that public infrastructure is mappable is actually beneficial. It helps enforce best practices rather than relying on the flawed 'no one will discover this endpoint' approach. > And it's a new single point of control and failure! This reasoning is flawed. X.509 certificates themselves embed SCTs. While log unavailability may temporarily affect new…

They are tradeoffs and it’s not all-or-nothing. There’s a reason security clearances exist, and that’s basically “security through obscurity”.

The argument here is that the loss of privacy and the incentives that will increase centralization might not be worth the gain in security for some folks, but good luck opting out. It basically requires telling bigco about your domains. How convenient for crawlers…

Re: Certificate Transparency in Firefox

#53

Post by Eikon »

gessha wrote: post #49
Eikon wrote: post #12

Shameless plug: Check out my Certificate Transparency monitor at https://www.merklemap.com The scale is massive, I just crossed 100B rows in the main database! :)

This is really cool! It discovered even subdomains that lived for a few days on my site. If it’s not a secret, how do you discover those? Is it by listening to DNS record changes?

By using... certificate transparency logs.

https://www.merklemap.com/documentation/how-it-works

Re: Certificate Transparency in Firefox

#54

Post by perching_aix »

mcpherrinm wrote: post #27
perching_aix wrote: post #16

Earlier quoted context omitted.

I believe so. You'll need to disable CT enforcement / or add your SPKI hash to the ignore list in the browser settings temporarily to get it working. [0] I guess this is also how corporations get around this issue? Still unsure. [0] https://wiki.mozilla.org/SecurityEngineering/Certificate_Tra...

No. CT is only required for public CAs. You only need those browser policy settings if you’re using a public CA without CT.

I'd imagine this is why certs that terminate in root certificates manually added to the trust store will work fine then [as stated by other comments]?

Re: Certificate Transparency in Firefox

#55

Post by perching_aix »

elmo2you wrote: post #41

I may be (legitimately) flagged for asking a question that may sound antagonizing ... but asked with sincerity: is at all smart to mention Firefox and transparency in the same sentence, at least at this particular moment in time? While this no doubt is an overall win, at least for most and in most cases, afaik this isn't completely without problems of its own. I just hope it won't lead to a systemd-like situation, wh…

I guess this is a good lesson on what the reasoning one would typically (and unfortunately) bring to a mainstream political thread results in when met with a topic from another area of life instead, particularly a technical one.

Especially this:

> where a cadre of (opinionated) people with power get to decide what's right from wrong, based on their beliefs about what might only be a subset of reality (albeit their only/full one at that).

This is always true. There's no arrangement where you can outsource reasoning and decisionmaking (by choice or by coercion) but also not. That's a contradiction.

Re: Certificate Transparency in Firefox

#56

Post by jeroenhd »

braiamp wrote: post #33

I am on Debian Firefox 135.0.1 and https://no-sct.badssl.com/ doesn't error out as expected. Is Debian doing something different?

135.0.1 on Ubuntu is warning me. Maybe Mozilla is doing a delayed rollout?

For context, in about:config my security.pki.certificate_transparency.mode is set to 2. According to https://wiki.mozilla.org/SecurityEngineering/Certificate_Tra... if it's on 0 (disabled) or 1 (not enforcing, collecting telemetry only), you can enable it.

I can imagine Mozilla setting that setting to 1 by default (collecting telemetry on sites you visit) and Debian overridding it for privacy purposes.

Re: Certificate Transparency in Firefox

#57

Post by elmo2you »

lxgr wrote: post #43
elmo2you wrote: post #41

I may be (legitimately) flagged for asking a question that may sound antagonizing ... but asked with sincerity: is at all smart to mention Firefox and transparency in the same sentence, at least at this particular moment in time? While this no doubt is an overall win, at least for most and in most cases, afaik this isn't completely without problems of its own. I just hope it won't lead to a systemd-like situation, wh…

You’re spot on: You are reacting seemingly without understanding the fundamentals of what you are reacting to. Certificate Transparency [1] is an important technology that improves TLS/HTTPS security, and the name was not invented by Mozilla to my knowledge. If Firefox were to implement a hypothetical IETF standard called “private caching”, would you also be cynical about Firefox “doing something private at this poin…

> You’re spot on: You are reacting seemingly without understanding the fundamentals of what you are reacting to.

What if I did (understand)? What if I knew a thing or two about it, even some lesser known details and side-effects? Maybe including a controversy or two, or at least an odd limitation and potential hazard at that. But, you correctly do point out that Firefox isn't to blame for implementing somebody else's "standard". Responsible for any and all consequences? Nonetheless, certainly yes.

Aside from now probably not being the best of times for Firefox, my main (potential) concern still stands. However, it is hardly a Firefox-only one, I'll give it that.

Re: Certificate Transparency in Firefox

#58

Post by bawolff »

elmo2you wrote: post #41

I may be (legitimately) flagged for asking a question that may sound antagonizing ... but asked with sincerity: is at all smart to mention Firefox and transparency in the same sentence, at least at this particular moment in time? While this no doubt is an overall win, at least for most and in most cases, afaik this isn't completely without problems of its own. I just hope it won't lead to a systemd-like situation, wh…

> is at all smart to mention Firefox and transparency in the same sentence, at least at this particular moment in time?

What are you expecting them to do? Rename the technology 1984 style?

> I just hope it won't lead to a systemd-like situation, where a cadre of (opinionated) people with power get to decide what's right from wrong, based on their beliefs about what might only be a subset of reality (albeit their only/full one at that).

This is a non sensical statement. I mean that literally. It does not make sense.

> Just have genuine concerns and reservations

Do you? Because it doesn't sound like it.

Re: Certificate Transparency in Firefox

#59

Post by Habgdnv »

samgranieri wrote: post #50

Hmm. I wonder how this will work with certificates generated by enterprise or private certificate authorities. Specifically, I use caddy for local web development and it generates a snake oil ca for anything on *.localhost using code from step-ca. I also use step-ca and bind to run a homelab top level domain and generate certs using rfc2136. I have to install that root ca cert everywhere, but it’s worth it

As of now, such stricter certificate requirements only apply to publicly trusted CAs that ship with the browser. Custom-added CAs are not subject to these requirements—this applies to all major browsers.

I haven't tested Firefox's implementation yet, but I expect your private CA to continue working as expected since it is manually added.

Private CAs can:

* Issue longer certificates, even 500 years if you want. Public CAs are limited to 1 year I think, or 2? I think it was 1..

* Can use weaker algorithms or older standards if they want.

* Not subject to browser revocation policies - no need for OCSP/CRL etc.

* More things that I do not know?

Re: Certificate Transparency in Firefox

#60

Post by bawolff »

elmo2you wrote: post #57
lxgr wrote: post #43

Earlier quoted context omitted.

You’re spot on: You are reacting seemingly without understanding the fundamentals of what you are reacting to. Certificate Transparency [1] is an important technology that improves TLS/HTTPS security, and the name was not invented by Mozilla to my knowledge. If Firefox were to implement a hypothetical IETF standard called “private caching”, would you also be cynical about Firefox “doing something private at this poin…

> You’re spot on: You are reacting seemingly without understanding the fundamentals of what you are reacting to. What if I did (understand)? What if I knew a thing or two about it, even some lesser known details and side-effects? Maybe including a controversy or two, or at least an odd limitation and potential hazard at that. But, you correctly do point out that Firefox isn't to blame for implementing somebody else's…

> What if I did (understand)?

I think its pretty clear you don't.

> What if I knew a thing or two about it, even some lesser known details and side-effects?

Then you would explicitly mention them instead of alluding to them.

People who know what they are talking about actually bring up the things that they are concerned about. They don't just say, i know an issue but im not going to tell you what it is.

Post reply on HN