top | item 40822817

(no title)

Sateallia | 1 year ago

Chrom(e/ium) and Safari don't trust certificates that are not in public logs [0].

[0] https://en.wikipedia.org/wiki/Certificate_Transparency#Manda...

discuss

order

schoen|1 year ago

Right, and that's a fundamental sea change in PKI security posture since the Iranian "ComodoHacker" and the Soghoian and Stamm compelled issuance paper! My point is just that some attackers might be willing to have their attacks show up in public logs if their victims are unlikely to ever notice that and if nobody else is likely to notice it either.

With Let's Encrypt we made a lot of people's certificate management a "fire and forget" thing, which is exactly what we hoped to do, but if they completely forget about it, it may be that there will be lots of targets against whom nobody would notice certificate misissuance.

Sateallia|1 year ago

I got every self-hosting sysadmin I know to run certificate monitors for sites they maintain but it certainly isn't a common thing to do. I know Cloudflare has a beta certificate monitoring feature which would certainly help a lot with this problem considering their market share if they enable it by default. (Although one problem with this is that they issue backup certificates from other CAs so it'd easily trigger warning fatigue!)

(I wasn't aware of your credentials when I made my previous comment so I assumed you didn't know about mandatory certificate transparency which is a mistake on my part, sorry! I'll make sure to check profile about sections before I assume again.)

aaomidi|1 year ago

The other argument is, why bother MITMing when you can go to Cloudflare and get them to share the data with you :)

yugcesofni|1 year ago

Not just Safari, but all TLS connections instantiated on Apple OSes