News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by jopsen on Sunday June 28, 2020 @05:59PM (#23672417)
Crazy idea: Why not serve an initial page over HTTP, and then implement encryption in JS using webcrypto for all subsequent calls.

I'm not sure self-signed HTTPS can do much better than this anyways.

(Yes, yes, it's a crazy idea, hehe)

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by dylz on Sunday June 28, 2020 @07:59PM (#23673046)
You can no longer do webcrypto because the initial page is compromised.

Self signed HTTPS works for this case as long as you know the fingerprint/cert to accept.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by jopsen on Tuesday June 30, 2020 @06:37AM (#23688701)
Oh, yeah... webcrypto only works on HTTPS.

So you would need to ship a crypto library in JS, hehe :)

Self-signed certs probably does work, if you install the certificate root on your machine. It just not something you would advice end-users to do.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by dylz on Tuesday June 30, 2020 @07:02AM (#23688826)
The other problem is shipping a crypto library if the entire page and script is not served over HTTPS means that it's no longer useful, because the crypto library is compromised.
[ Parent | on HN ]