Hacker News new | ask | show | jobs
by kristofferR 4131 days ago
Why doesn't the browsers collect information from its users (if they agree to it) about which CAs are used by which domains - and display a strong warning if a different CA than the norm tries to issue a certificate?
3 comments

EFF's SSL Observatory [1] does collect information on certs used by SSL enables sites for research purposes.

[1] https://www.eff.org/observatory

Because the m/billions of users bar a few thousand will have no idea what to make of the warning. I mean I don't even know what constitutes a "normal" CA.

And to be honest who really cares. Countries increasingly are mandating invasive spying through legislation. Arguing over CAs is like rearranging deckchairs on the titanic.

It wouldn't be much different than certificate pinning is today, just a crowdsourced version.

Sure, the CA system should be replaced altogether, but that's going to take quite some time. In the mean time I think the idea I mentioned could be useful to avoid invisible man-in-the-middle attacks by the CAs. It only requires work by the browser developers, while changing from CAs to something else will take a major effort by everyone who's running a part of the web.

Users don't react well to such warnings, but on the software side there is the emergent concept of certificate pinning -- Chrome, for instance, reports to the mothership if an unexpected CA is found to have generated a Google certificate (it simply flags on an unexpected certificate, though usually that means an untrusted CA). Not sure about the scalability of the solution, but ultimately domains should be able to securely delegate authoritative CAs.

https://www.imperialviolet.org/2011/05/04/pinning.html

However then you get to the same market issue that allowed the whole Superfish and related debacles -- Enterprises require the ability to self-CA everyone else given that they demand the right to MITM.