News for hackers. Stuff that matters.

A comment on Mozilla to Certificate Authorities: no subordinate CAs for traffic interception. Parent comment

Re:Mozilla to Certificate Authorities: no subordinate CAs fo... by simonbrown on Saturday February 18, 2012 @10:11AM (#3606728)
Or, what if the user's browser requested a site's public key on its first visit, but required it to be signed with a trusted CA? So to perform a MITM on an SSL connection, Mallory would have to both infiltrate a CA and MITM the user's connection on their first visit to a site.
[ Parent | on HN ]
Re:Mozilla to Certificate Authorities: no subordinate CAs fo... by caf on Sunday February 19, 2012 @03:07AM (#3608922)
You can have this today by running Firefox with the Certificate Patrol plugin.
[ Parent | on HN ]
Re:Mozilla to Certificate Authorities: no subordinate CAs fo... by simonbrown on Sunday February 19, 2012 @09:30AM (#3609412)
Though the system I suggested lets a site change CA.
[ Parent | on HN ]
Re:Mozilla to Certificate Authorities: no subordinate CAs fo... by caf on Sunday February 19, 2012 @06:59PM (#3610787)
When a site's certificate changes, Certificate Patrol shows you what has changed, including the public key fingerprint. So you easily detect the case when the site changes CA without changing their public key.
[ Parent | on HN ]