News for hackers. Stuff that matters.

A comment on Some observations on the final text of the European Digital Identity framework. Parent comment

Re:Some observations on the final text of the European Digit... by amluto on Friday November 24, 2023 @02:42PM (#38407420)
I filed the obvious bug against Firefox ten years ago :(

https://bugzilla.mozilla.org/show_bug.cgi?id=953322

[ Parent | on HN ]
Re:Some observations on the final text of the European Digit... by devman0 on Friday November 24, 2023 @06:11PM (#38409397)
Do browsers check the CAA records for a domain if they exist? Seems like that would solve the issue.
[ Parent | on HN ]
Re:Some observations on the final text of the European Digit... by g_p on Friday November 24, 2023 @08:02PM (#38410101)
No, and the standard (RFC 6844) says they must not. That's because, in the eyes of the standard, a CAA record is applicable at time of issuance, but a valid certificate could have been previously issued (and still be valid), even though you've moved to a new CAA record for your next certificate.

"Relying Applications MUST NOT use CAA records as part of certificate validation."

For what you're looking for, DANE (RFC 6698) would be more useful and enable the browser to check the presented certificate against DNS (so effectively CAA on the client).

[ Parent | on HN ]
Re:Some observations on the final text of the European Digit... by ekr____ on Friday November 24, 2023 @07:29PM (#38409923)
As far as I know, they do not.

Even if they did, it doesn't really address the problem. In order to mount an effective impersonation attack, the attacker needs to either control the network or the DNS. In either case, they will generally be able to remove or change the CAA record; remember that DNSSEC deployment is comparatively rare and browsers do not verify DNSSEC in any case.

[ Parent | on HN ]