Why TLS 1.3 isn't in browsers yet

Re:Why TLS 1.3 isn't in browsers yet by wyldfire on Thursday December 28, 2017 @01:25AM (#16020677)

I wish browsers would visually distinguish between the vanilla trust store from the OS or browser vendor and the current trust store as may have been altered by the system owner. Maybe the API to various certificate stores can't tell you this? But in practice there's probably some certificate qualities that are "really really good" at indicating where this connection is trusted on this computer but would not have been trusted by a newly installed Windows/macOS/linux/firefox/chrome system.

If you are going to spy on me, please disclose when and where. AFAIK w/HSTS sites they generally don't interdict the traffic (not because they don't want to but probably because they can't).

[ Parent | on HN ]

Re:Why TLS 1.3 isn't in browsers yet by DKnoll on Thursday December 28, 2017 @08:39AM (#16021915)

HSTS only says connections must be encrypted, not with which cert... you're thinking of a CAA record. Although a CAA record doesn't mean much if your adversary controls the DNS server.

[ Parent | on HN ]

Re:Why TLS 1.3 isn't in browsers yet by yrro on Friday December 29, 2017 @11:02AM (#16030080)

I think you're thinking of HTTP Public Key Pinning. A CAA record just tells a CA whether it is permitted to issue certificates for a domain.

[ Parent | on HN ]

Re:Why TLS 1.3 isn't in browsers yet by DKnoll on Friday December 29, 2017 @11:19AM (#16030181)

Well actually I think you mean... no just kidding. Thanks for the correction. I thought CAA records would also tell clients if a trusted root was also trusted for that domain.

[ Parent | on HN ]