The Right to Lie and Google’s “Web Environment Integrity”

Re:The Right to Lie and Google’s “Web Environment Integrity” by paulmd on Sunday July 30, 2023 @07:44PM (#36937229)

Well, any time anyone might be loading up a website for the first time in a coffee shop.

Also, “remember this cert forever” (cert pinning) has been an ops disaster for a lot of sites that have tried it. So in practice “the first time” might be more like every week or every month. What the risk that a coffee shop will not serve you a malicious cert once a week?

Also if they do it and you move back to your home connection… the site is broken there because now it’s returning a different one than was pinned (by the attacker!).

[ Parent | on HN ]

Re:The Right to Lie and Google’s “Web Environment Integrity” by apostacy on Sunday July 30, 2023 @10:05PM (#36938080)

There are plenty of ways to improve security but maintain openness.

I think a good idea might be to have TOFU and self-signed only as a fallback. If there was no initial mismatch, and then upate cert periodically.

[ Parent | on HN ]