Hacker News Reader

Comment by kernelPan1c | Hacker News Reader

Yes, greater for security but still depends upon reliability of certificate authorities and ISPs. ISPs have the ability to issue the client a bogus certificate while they hold the real one in order to decrypt traffic. Why won't browsers allow the certificate's public key to be readable by javascript so that the remote server can verify the client has the correct certificate? This wouldn't be foolproof but it would significantly beef up security.

Similar to how tor hidden services get resolved, distributed hash tables seem like the way to go. Take the ISPs and Cert Authorities out of the equation.

View on HN

Making the public key of the remote available to JS wouldnt help because if you can't trust the identity of the remote server or integrity of the connection then you can't trust the javascript.

Tor hidden services are secure because of the lack of human meaningful names.

See: https://en.wikipedia.org/wiki/Zooko%27s_triangle

Yes, since you can't trust the JS, doing this would be an attempt at security through obfuscation. I mostly just think it's strange that these keys aren't accessible. If there were ever a mismatch detected, the server could at least know with certainty that there's a bad actor on the connection.

Thanks for Zooko's Traingle wiki. Hadn't seen that one before.

> Why won't browsers allow the certificate's public key to be readable by javascript

Because sites would randomly block reverse proxies, web proxies, enterprise users, people using certain WiFi APs, and it would give advertisers another thing to track users on.

Frankly after looking at what websites did with the User Agent, I'm scared to see what they'd do when a certificate mismatch occurs.

I thought modern browsers ship with pinned certificates for Google and other large companies built in to the browser download.

Public key pinning helps but it operates on the assumption that the initial key is the correct one. I find it curious that these public keys are not readable by the client.

Reply on news.ycombinator.com