Hacker News Reader

Comment by rictic | Hacker News Reader

Browser makers and others have been trying to fix this, it is actually harder than it looks. HSTS, certificate transparency, and shipping pre-pinned certs with the browser are all approaches pushed forward by browser makers. As an example of how this is harder than it looks one need only look to DNSSEC.

View on HN

pushed forward by browser makers

Huh? Which browser alerts me when the cert changes from the previous one that it has seen for a site?

That would be the most basic and trivial mitigation for a start. What we see instead is consortium paralysis for decades. Occam's razor much?

HSTS does nothing for certificate trust. And the other two you mentioned still conveniently keep us at the mercy of browser vendors and infrastructure owners.

Don't drink the snake oil.

Which browser alerts me when the cert changes from the previous one that it has seen for a site?

This alone would make self-signing much more viable for many uses.

Firefox + self-signed certs forces you to add an exception for the site, which makes the cert work and shouts at you again if that cert ever changes, so fulfilling the above. :)

Sure, but that is only helpful if you remember that the site had previously worked before. Otherwise, it's just like your first time visiting it.

Yes it would be nice if the browser prompted more suspicion in those cases when a self-signed cert changes than when one is simply used for the first time. (Theoretically the changing of a regular CA-signed cert shouldn't prompt any suspicion, but I wonder...)

Sites need to be able to update their certs without giving a scary warning to all their repeat visitors.

Sites need to be able to update their certs without giving a scary warning to all their repeat visitors.

Why?

Why shouldn't sites be forced to announce these changes beforehand?

Why can't we have a "defer all trust to $certificate_authority"-button for the lazy users?

Why is "blind trust" still the default after all these years?

Why can't I even selectively enable a warning when the certificate changes for sites that I really care about (like my bank)?

CloudFlare could also provide DANE support.

Reply on news.ycombinator.com