On Mon, Dec 25, 2017 at 7:10 AM, Adrian R. via dev-security-policy <dev-security-policy@lists.mozilla.org> wrote: > since it's a webserver running on the local machine and is using that > certificate key/pair, i think that someone more capable than me can easily > extract the key from it. > > From my point of view as an observer it's plainly obvious that the private > key must be on my local machine too, even if i haven't actually got to the > key itself yet.
The problem is that this is not true. I've not investigated this software at all, but there are two designs I have seen in other software: 1) TCP Proxy: A pure TCP proxy could be forwarding all the packets to another host which has the key. 2) "Keyless" SSL: https://www.cloudflare.com/ssl/keyless-ssl/ - they key is on a different host from the content I'm sure there are other designs which would end up with the same result: 127.0.0.1 does not have the private key. Given this, conjecture that there "must" be a private key compromise seems exaggerated. Thanks, Peter _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
