Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Certificate Transparency in Firefox

blog.transparency.dev

Post reply on HN
Print view View original

61–70 of 116 posts

Re: Certificate Transparency in Firefox

#61

Post by elmo2you »

perching_aix wrote: post #55
elmo2you wrote: post #41

I may be (legitimately) flagged for asking a question that may sound antagonizing ... but asked with sincerity: is at all smart to mention Firefox and transparency in the same sentence, at least at this particular moment in time? While this no doubt is an overall win, at least for most and in most cases, afaik this isn't completely without problems of its own. I just hope it won't lead to a systemd-like situation, wh…

I guess this is a good lesson on what the reasoning one would typically (and unfortunately) bring to a mainstream political thread results in when met with a topic from another area of life instead, particularly a technical one. Especially this: > where a cadre of (opinionated) people with power get to decide what's right from wrong, based on their beliefs about what might only be a subset of reality (albeit their on…

> This is always true. There's no arrangement where you entrust someone else with decisionmaking (by choice or not nonwithstanding) but then they're somehow not the ones performing the decisionmaking afterwards.

I'm well aware of that. On itself there isn't a problem with it, in principle at least. Right until it leads to bad decisions being pushed through, and more often in ignorance rather than malice. I personally only have a real problem with it when people or tech ends up harmed or even destroyed, just because of ignorance rather than deliberate arbitrary choices (after consideration, hopefully).

To be clear, I'm not saying that any of that is the case here. But lets just say that browser vendors in general, and Mozilla as of lately in particular, aren't on my "I trust you blindly at making the right decisions" list.

Re: Certificate Transparency in Firefox

#62

Post by perching_aix »

elmo2you wrote: post #61
perching_aix wrote: post #55

Earlier quoted context omitted.

I guess this is a good lesson on what the reasoning one would typically (and unfortunately) bring to a mainstream political thread results in when met with a topic from another area of life instead, particularly a technical one. Especially this: > where a cadre of (opinionated) people with power get to decide what's right from wrong, based on their beliefs about what might only be a subset of reality (albeit their on…

> This is always true. There's no arrangement where you entrust someone else with decisionmaking (by choice or not nonwithstanding) but then they're somehow not the ones performing the decisionmaking afterwards. I'm well aware of that. On itself there isn't a problem with it, in principle at least. Right until it leads to bad decisions being pushed through, and more often in ignorance rather than malice. I personally…

I do see pretty massive problems with it, such as those you list off, but the unfortunate truth is that one cannot know or do everything themselves. So usually it's not even a choice but a coercive scenario.

For example, say I want to ensure my food is safe to eat. That would require farmland where I can grow my own food. Say I buy some, but then do I have the knowledge and the means to figure out whether the food I grew is actually safe to eat? After all, I just bought some random plot of farmland, how would I know what was in it? Maybe it wasn't even the land that's contaminated but instead the wind brought over some chance contamination? And so on.

Re: Certificate Transparency in Firefox

#64

Post by lxgr »

jeroenhd wrote: post #56
braiamp wrote: post #33

I am on Debian Firefox 135.0.1 and https://no-sct.badssl.com/ doesn't error out as expected. Is Debian doing something different?

135.0.1 on Ubuntu is warning me. Maybe Mozilla is doing a delayed rollout? For context, in about:config my security.pki.certificate_transparency.mode is set to 2. According to https://wiki.mozilla.org/SecurityEngineering/Certificate_Tra... if it's on 0 (disabled) or 1 (not enforcing, collecting telemetry only), you can enable it. I can imagine Mozilla setting that setting to 1 by default (collecting telemetry on site…

Does the browser actually communicate with any external service for enforcing CT?

I was under the impression it just checked the certificate for an inclusion proof, and actual monitoring of consistency between these proofs and logs is done by non-browser entities.

Re: Certificate Transparency in Firefox

#65

Post by tgsovlerkhgsel »

Eikon wrote: post #12

Shameless plug: Check out my Certificate Transparency monitor at https://www.merklemap.com The scale is massive, I just crossed 100B rows in the main database! :)

Are you continuously monitoring consistency proofs? Or in other words, would someone (you or someone else) actually notice if a log changed its contents retroactively?

Re: Certificate Transparency in Firefox

#66

Post by tgsovlerkhgsel »

lxgr wrote: post #64
jeroenhd wrote: post #56

Earlier quoted context omitted.

135.0.1 on Ubuntu is warning me. Maybe Mozilla is doing a delayed rollout? For context, in about:config my security.pki.certificate_transparency.mode is set to 2. According to https://wiki.mozilla.org/SecurityEngineering/Certificate_Tra... if it's on 0 (disabled) or 1 (not enforcing, collecting telemetry only), you can enable it. I can imagine Mozilla setting that setting to 1 by default (collecting telemetry on site…

Does the browser actually communicate with any external service for enforcing CT? I was under the impression it just checked the certificate for an inclusion proof, and actual monitoring of consistency between these proofs and logs is done by non-browser entities.

No, I assume but Mozilla was first collecting telemetry to see if enabling CT would cause user-visible errors or not.

Re: Certificate Transparency in Firefox

#67

Post by lxgr »

elmo2you wrote: post #61
perching_aix wrote: post #55

Earlier quoted context omitted.

I guess this is a good lesson on what the reasoning one would typically (and unfortunately) bring to a mainstream political thread results in when met with a topic from another area of life instead, particularly a technical one. Especially this: > where a cadre of (opinionated) people with power get to decide what's right from wrong, based on their beliefs about what might only be a subset of reality (albeit their on…

> This is always true. There's no arrangement where you entrust someone else with decisionmaking (by choice or not nonwithstanding) but then they're somehow not the ones performing the decisionmaking afterwards. I'm well aware of that. On itself there isn't a problem with it, in principle at least. Right until it leads to bad decisions being pushed through, and more often in ignorance rather than malice. I personally…

> browser vendors in general, and Mozilla as of lately in particular, aren't on my "I trust you blindly at making the right decisions" list.

That's entirely fair. But what does this have to do with Mozilla's decision to enforce Certificate Transparency in Firefox?

If you have a concrete concern, voicing it could lead to a much more productive discussion than exuding a general aura of distrust, even if warranted.

Re: Certificate Transparency in Firefox

#68

Post by lxgr »

tgsovlerkhgsel wrote: post #66
lxgr wrote: post #64

Earlier quoted context omitted.

Does the browser actually communicate with any external service for enforcing CT? I was under the impression it just checked the certificate for an inclusion proof, and actual monitoring of consistency between these proofs and logs is done by non-browser entities.

No, I assume but Mozilla was first collecting telemetry to see if enabling CT would cause user-visible errors or not.

Ah, good point – presumably 2 also sends telemetry to Mozilla?

Re: Certificate Transparency in Firefox

#69

Post by cpach »

perching_aix wrote: post #19

Would be cool if DANE/TLSA record checks were also implemented. Not sure why browsers are not adopting it.

DNSSEC has aged very poorly. I also believe it operates at the wrong layer. When you surf to chase.com you want to make be sure that the website you see is actually JPMorganChase and not Mallory’s fake bank site. That’s why we have HTTPS and the WebPKI. If your local DNS server is poisoned somehow that’s obviosly not good, but it cannot easily send you to a fake version of chase.com.

Part of why it’s so hard for Mallory to create a fake version of a bank site is Certificate Transparency. It makes it much much harder to issue a forged certificate that a browser such as Chrome, Safari or Firefox will accept.

For further info about the flaws of DNSSEC I can recommend this article: https://sockpuppet.org/blog/2015/01/15/against-dnssec/ It’s from 2015 but I don’t think anything has really changed since that.

Post reply on HN