Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Certificate Transparency in Firefox

blog.transparency.dev

Post reply on HN
Print view View original

81–90 of 116 posts

Re: Certificate Transparency in Firefox

#81

Post by brookst »

tgsovlerkhgsel wrote: post #28
joelthelion wrote: post #3

Can someone explain in a nutshell what CT is, and how does it help security for the average user?

It's a public, tamper-proof log of all certificates issued. When a CA issues a certificate, it sends a copy to at least two different logs, gets a signed "receipt", and the receipt needs to be included in the certificate or browsers won't accept it. The log then publishes the certificate. This means that a CA cannot issue a certificate (that browsers would accept) without including it in the log. Even if a government…

Thanks for the great explanation of both tech design and real world benefits!

Re: Certificate Transparency in Firefox

#82

Post by Etheryte »

Eikon wrote: post #12

Shameless plug: Check out my Certificate Transparency monitor at https://www.merklemap.com The scale is massive, I just crossed 100B rows in the main database! :)

I'm clearly not the target audience for this, so excuse me if this is a dumb question: what is this tool used for? Who would usually use it and for what purpose?

Re: Certificate Transparency in Firefox

#83

Post by tialaramex »

lxgr wrote: post #46
tialaramex wrote: post #40

Earlier quoted context omitted.

The reason browsers didn't implement DANE is because most people's DNS servers are garbage, so if you do this the browser doesn't work and "if you changed last you own the problem". At the time if you asked a typical DNS server e.g. at an ISP or built into a cheap home router - any type of question except "A? some.web.site.example" you get either no answer or a confused error. What do you mean records other than A ex…

> if you asked a typical DNS server e.g. at an ISP or built into a cheap home router - any type of question except "A? some.web.site.example" you get either no answer or a confused error. Really? Because that would mean that anything using SRV records wouldn’t work on home routers, yet it’s an integral part of many protocols at this point. There’s some room between “my DNS resolver doesn’t do DNSSEC” and “I can only…

Yes really. Like I said - even AAAA though better than it was isn't as reliable as A, the "Happy Eyeballs" tactic makes that tolerable, maybe 90% of your customers have IPv6, get the AAAA answer quickly, reach the IPv6 endpoint, awesome. 9% only have IPv4 anyway, get IPv4 endpoint, also fine, but 1% the AAAA query never returns, a few milliseconds later the IPv4 connection succeeds and the AAAA query is abandoned so who cares.

I'd guess that you if you build something which needs SRV? to "Just work" in 2025, not "nice to have" but as a requirement, you probably lose 1-2% of your potential users for that. It might be worth it. But if you need 100% you'll want a fallback. I suggest built-in DoH to, say, Cloudflare.

Re: Certificate Transparency in Firefox

#84

Post by Eikon »

grayhatter wrote: post #74
tzs wrote: post #71

Earlier quoted context omitted.

> You're essentially advocating for security through obscurity So? The problem with security through obscurity is when it is the only security you are using. I didn't see anything in his comment that implied his only protection was the secrecy of his endpoints. Security through obscurity can be fine when used in addition to other security measures, and has tangible benefits in a significant fraction of real world sit…

> So? The problem with security through obscurity is when it is the only security you are using. I didn't see anything in his comment that implied his only protection was the secrecy of his endpoints. Directly, or unintentionally implied or not. That's an implication you're allowed to infer when obscurity is the only thing listed, because it's *very* common that is the only defense mechanism. Also, when given the cho…

Thank you for putting this up so clearly!

Re: Certificate Transparency in Firefox

#85

Post by Uvix »

Habgdnv wrote: post #59
samgranieri wrote: post #50

Hmm. I wonder how this will work with certificates generated by enterprise or private certificate authorities. Specifically, I use caddy for local web development and it generates a snake oil ca for anything on *.localhost using code from step-ca. I also use step-ca and bind to run a homelab top level domain and generate certs using rfc2136. I have to install that root ca cert everywhere, but it’s worth it

As of now, such stricter certificate requirements only apply to publicly trusted CAs that ship with the browser. Custom-added CAs are not subject to these requirements—this applies to all major browsers. I haven't tested Firefox's implementation yet, but I expect your private CA to continue working as expected since it is manually added. Private CAs can: * Issue longer certificates, even 500 years if you want. Public…

Public CAs are currently limited to 398 days (effectively 13 months).

Re: Certificate Transparency in Firefox

#87

Post by immibis »

Eikon wrote: post #12

Shameless plug: Check out my Certificate Transparency monitor at https://www.merklemap.com The scale is massive, I just crossed 100B rows in the main database! :)

I tried to do something like this one time and had a problem just finding the logs. All information on the internet points to the fact that certain logs exist, but not how to access them. Are they not public access? Do you have a B2B relationship with the companies like Cloudflare that run logs?

Re: Certificate Transparency in Firefox

#88

Post by Eikon »

Etheryte wrote: post #82
Eikon wrote: post #12

Shameless plug: Check out my Certificate Transparency monitor at https://www.merklemap.com The scale is massive, I just crossed 100B rows in the main database! :)

I'm clearly not the target audience for this, so excuse me if this is a dumb question: what is this tool used for? Who would usually use it and for what purpose?

Anyone setting up infrastructure, security researchers, security teams and IT teams.

It’s also actually very useful too in the brand management field, especially to detect phishing websites.

Post reply on HN