Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Certificate Transparency in Firefox

blog.transparency.dev

Post reply on HN
Print view View original

41–50 of 116 posts

Re: Certificate Transparency in Firefox

#41

Post by elmo2you »

I may be (legitimately) flagged for asking a question that may sound antagonizing ... but asked with sincerity: is at all smart to mention Firefox and transparency in the same sentence, at least at this particular moment in time?

While this no doubt is an overall win, at least for most and in most cases, afaik this isn't completely without problems of its own. I just hope it won't lead to a systemd-like situation, where a cadre of (opinionated) people with power get to decide what's right from wrong, based on their beliefs about what might only be a subset of reality (albeit their only/full one at that).

Not trying to be dismissive here. Just have genuine concerns and reservations. Even if mostly intuitively for now; no concrete ones yet. Maybe it's just a Pavlov-reaction, after reading the name Firefox. Honestly can't tell.

Re: Certificate Transparency in Firefox

#42

Post by Eikon »

AznHisoka wrote: post #39
Eikon wrote: post #12

Shameless plug: Check out my Certificate Transparency monitor at https://www.merklemap.com The scale is massive, I just crossed 100B rows in the main database! :)

Why do it only show a few subdomains for .statuspage.io? I would have expected at least 10K or so. https://www.merklemap.com/search?query=*.statuspage.io&page=... Is my query wrong or are you just showing less results intentionally if you’re not paying?

> Why do it only show a few subdomains for .statuspage.io? I would have expected at least 10K or so. https://www.merklemap.com/search?query=*.statuspage.io&page=...

Because they have a wildcard for *.statuspage.io, which they are probably hosting their pages on.

> Is my query wrong or are you just showing less results intentionally if you’re not paying?

No, results are the same but not sorted.

Re: Certificate Transparency in Firefox

#43

Post by lxgr »

elmo2you wrote: post #41

I may be (legitimately) flagged for asking a question that may sound antagonizing ... but asked with sincerity: is at all smart to mention Firefox and transparency in the same sentence, at least at this particular moment in time? While this no doubt is an overall win, at least for most and in most cases, afaik this isn't completely without problems of its own. I just hope it won't lead to a systemd-like situation, wh…

You’re spot on: You are reacting seemingly without understanding the fundamentals of what you are reacting to.

Certificate Transparency [1] is an important technology that improves TLS/HTTPS security, and the name was not invented by Mozilla to my knowledge.

If Firefox were to implement a hypothetical IETF standard called “private caching”, would you also be cynical about Firefox “doing something private at this point in time” without even reading up what the technology in question does?

[1] https://en.wikipedia.org/wiki/Certificate_Transparency

Re: Certificate Transparency in Firefox

#44

Post by lxgr »

greatgib wrote: post #34

In theory it is good, but somehow it is also a big threat to privacy and security of your infrastructure. No need anymore to scan your network to map the complete endpoints of your infrastructure! And it's a new single point of control and failure!

> And it's a new single point of control and failure!

That’s why there is a mandatory minimum of several unaffiliated logs that each certificate has to be submitted to.

If all of these were to catastrophically fail, it would still always be possible for browsers or central monitors to fall back to trusting certificates logged by exactly these without inclusion verification.

Re: Certificate Transparency in Firefox

#45

Post by masfuerte »

braiamp wrote: post #33

I am on Debian Firefox 135.0.1 and https://no-sct.badssl.com/ doesn't error out as expected. Is Debian doing something different?

I do get the warning using the same Firefox version on Windows.

Note that the link in the article is mangled. The link text is https://no-sct.badssl.com/>, but the actual href points to https://certificate.transparency.dev/useragents/>. Your comment has the correct link which gives the warning.

Re: Certificate Transparency in Firefox

#46

Post by lxgr »

tialaramex wrote: post #40
perching_aix wrote: post #19

Would be cool if DANE/TLSA record checks were also implemented. Not sure why browsers are not adopting it.

The reason browsers didn't implement DANE is because most people's DNS servers are garbage, so if you do this the browser doesn't work and "if you changed last you own the problem". At the time if you asked a typical DNS server e.g. at an ISP or built into a cheap home router - any type of question except "A? some.web.site.example" you get either no answer or a confused error. What do you mean records other than A ex…

> if you asked a typical DNS server e.g. at an ISP or built into a cheap home router - any type of question except "A? some.web.site.example" you get either no answer or a confused error.

Really? Because that would mean that anything using SRV records wouldn’t work on home routers, yet it’s an integral part of many protocols at this point.

There’s some room between “my DNS resolver doesn’t do DNSSEC” and “I can only resolve A records”.

Re: Certificate Transparency in Firefox

#47

Post by perching_aix »

Avamander wrote: post #30
perching_aix wrote: post #19

Would be cool if DANE/TLSA record checks were also implemented. Not sure why browsers are not adopting it.

DNSSEC is not a good PKI, that's why. There are basically no rules on how to properly operate it, even if there were, there'd be no way to enforce them. There's also almost zero chance a leaked key would ever be detected.

I'm not sure I follow, could you please elaborate a bit more? I'm not really suggesting DNS to be exclusively used for PKI over the current Web PKI system of public CAs either.

Re: Certificate Transparency in Firefox

#48

Post by perching_aix »

tialaramex wrote: post #40
perching_aix wrote: post #19

Would be cool if DANE/TLSA record checks were also implemented. Not sure why browsers are not adopting it.

The reason browsers didn't implement DANE is because most people's DNS servers are garbage, so if you do this the browser doesn't work and "if you changed last you own the problem". At the time if you asked a typical DNS server e.g. at an ISP or built into a cheap home router - any type of question except "A? some.web.site.example" you get either no answer or a confused error. What do you mean records other than A ex…

I guess I did forget that me using Cloudflare and Google as my DNS is not a normal setup to have...

But surely it doesn't have to be so black and white? TLSA enforcement is not even a hidden feature flag in mainstream web clients, it's just completely non-existent to my knowledge.

Re: Certificate Transparency in Firefox

#49

Post by gessha »

Eikon wrote: post #12

Shameless plug: Check out my Certificate Transparency monitor at https://www.merklemap.com The scale is massive, I just crossed 100B rows in the main database! :)

This is really cool! It discovered even subdomains that lived for a few days on my site. If it’s not a secret, how do you discover those? Is it by listening to DNS record changes?

Re: Certificate Transparency in Firefox

#50

Post by samgranieri »

Hmm. I wonder how this will work with certificates generated by enterprise or private certificate authorities. Specifically, I use caddy for local web development and it generates a snake oil ca for anything on *.localhost using code from step-ca.

I also use step-ca and bind to run a homelab top level domain and generate certs using rfc2136. I have to install that root ca cert everywhere, but it’s worth it

Post reply on HN