Reviews.
Certificate Patrol can really save your pocket says Paolo Campegiani.
al_9x suggests we should combine CertPatrol with Perspectives in a single add-on, but they already do great team work side by side, no?
factorbee provides the advice to install CertPatrol when going on a tour using the Tor, because some Tor exit nodes will try MITM attacks against you.
Phocean was unhappy about the number of "false positives" with CertPatrol. So was tanstaafl. In our idea of safety, paranoia comes first, but if we can safely reduce the number of messages, we will. In fact we did recently with 1.2.3 and will with the upcoming versions and betas. Do try out the beta versions if you need more intelligent Patrol immediately.
It's all about trust! says d0mber.
Schneelocke has "no idea why these things aren't done by the browser by default, anyway."
This paragraph is about a paper released in March, 2010. Nothing has happened since then and the 'Certlock' add-on that was announced was never published, so you may very well choose to skip reading this box. It isn't all that interesting really.
In the world of scientific research, it can occasionally happen, that the research you intend to do has already been implemented by some open source folks. What do you do when that happens? Cite some nerds in your paper as if they were proper researchers? Find some creative reasons why their work just won't cut it?
On March 24th, 2010, Christopher Soghoian published a paper: "Certified Lies: Detecting and Defeating Government Interception Attacks Against SSL" cited by the EFF and others. Apparently this was news to some people, that governments can use their certification authorities for the purpose of generating false certificates and eavesdropping by man-in-the-middle attack on SSL connections where they deem necessary. Others have heard of the Bundestrojaner before, and figured out how that would really work.
Certificate Patrol has been specifically designed to address this kind of threat. Alright, it's a nice paper, but given that this add-on is the only existing solution to the problem it shouldn't just be mentioned as an example on how not to do it ("7.3 Avoiding False Positives") then ignored in "Related Work", where all other relevant developers are mentioned by name except for us.
In 7.4 then the paper advertises an unfinished add-on that does the same job as Certificate Patrol, only it intends to detect when an evil government is attempting to spy on you, not when it is your good government or when it is your employer. Also it mentions some things that could have come straight from our TODO list.
Yes it is true that X.509 and all of its certificate business isn't easy for the average users, but it is better to inform and educate them properly rather than make some simplified automated decisions which might just horribly backfire. This way you're creating new levels of pseudo security.
How can you employ a Trust-On-First-Use policy, if the MITM attack against you may already be in place?
Why shouldn't your government care to eavesdrop on your bank transactions in your own country?
Why should it be hard for an attacker to obtain an intermediate CA based in the US, to
circumvent your country-based whitelisting strategy?
Certificate Patrol informs you of things happening, keeps you in control and doesn't hide the complexity of reality from you.
The approach of Certlock is fundamentally flawed even before it has been released.
Sometimes a sense of security is worse than dealing with reality.
It's interesting how many follow-up blog articles are being written about this paper, with people wondering whether the Certlock approach is valid or not yet the psychology of writing a negative paragraph about what could actually be the solution has exactly the intended result: None of these professionals, who presumably carefully read the paper, seem to have considered trying out something after reading a "don't even bother to try it" opinion. None even mentioned in their summaries that there may already be something out there to do the job.
Negative advertisement is several times more powerful than positive advertisement. We are all sensitized to not trust someone when she tries to sell us something, but not when someone is trying to inject reasons to consider something invalid.
At least endisnighe kept his mind awake while reading.
For the nitpicky: Section 8 of the paper lists some scenarios where Certlock would or wouldn't be helpful. It would not be helpful whenever the attacker compells the same CA that issued the original certificate (Scenario A — something feasible for the American government and its agencies). With Certificate Patrol the new certificate would show up. You would be able to tell something is wrong if the expiry wasn't due. Same goes for Scenario B where the attacker uses a different CA based in the same country as the original CA. Same for Scenario C, as it is the same as Scenario A. Also in Scenario F, a Chinese website using an American CA being attacked with another American CA. Something Certlock would not detect, CertPatrol would. Considering that Chinese government could buy an intermediate CA from one of various CAs worldwide, it doesn't need to use the obvious CNNIC (Chinese Internet NIC Authority recently added to Firefox — should spell CINIC actually) certificate — so Certlock doesn't even properly protect those it aims to protect most: Chinese citizen.
Related Articles.
Yet another reason to install Cert Patrol: Mozilla developers do not remember why the "RSA Security 1024 V3" root certificate was added. Orphaned root authorities! Can you imagine? It's "sleeper cells" for your web browser. (via Jan/fefe)
Law Enforcement Appliance Subverts SSL.
phobos on Life without a CA.
Some articles in German:
fefe, Ich möchte gerne, dass Firefox mir mitteilt, wenn ich zu einer SSL-Site gehe, bei der ich schon früher mal war, und sich der Schlüssel geändert hat. Und fefe will, dass das Firefox auch ohne add-ons kann. Ich denke wir können Firefox forken, das geht schneller und ist zuverlässiger.
Isotopp, Ein paar Worte zu SSL.
ManIP hat es bereits selbst erlebt: Firmen fangen systematisch alle SSL-Verbindungen ab.
putzo schreibt über PKI, CNNIC und RSA Security 1024.
Kai Ravens Empfehlungen zum "Tuning" von Firefox.
Christian Gresser probiert's einfach mal aus.
Financial Cryptography, 2004-09-01: "VeriSign is offering protection from snooping, and on the other hand, is offering to facilitate the process of snooping."
Since 2000: Public Key Infrastructure considered harmful
| 
