Re: HOW to set “security.OCSP.require” in Google Chrome/Chromium?
On Thu, Mar 24, 2011 at 07:58:48 -0700, johhny_at_poland77 johhny_at_polan...@zoho.com wrote: https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion Users of Mozilla Firefox that are concerned about this issue should enable security.OCSP.require in the about:config dialog. How can i enable this feature in Google Chrome/Chromium? about:config is a URL that you can visit. You can then click on the the setting to modify it's value. You can also type in a pattern to use as a filter so that there are less settings shown. Depnding on what you are really worried about, you might be better off totally disabling the checking the bad certificate list instead of bothering to have the black list block access to web pages. Sending all of the certifictes you visit to the CA to verify may be a bigger security risk than being tricked into visiting a web page with an incorrectly issued certificate. -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Re: HOW to set “security.OCSP.require” in Google Chrome/Chromium?
On Thu, 2011-03-24 at 13:29 -0500, Bruno Wolff III wrote: On Thu, Mar 24, 2011 at 07:58:48 -0700, johhny_at_poland77 johhny_at_polan...@zoho.com wrote: https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion Users of Mozilla Firefox that are concerned about this issue should enable security.OCSP.require in the about:config dialog. How can i enable this feature in Google Chrome/Chromium? about:config is a URL that you can visit. You can then click on the the setting to modify it's value. You can also type in a pattern to use as a filter so that there are less settings shown. Depnding on what you are really worried about, you might be better off totally disabling the checking the bad certificate list instead of bothering to have the black list block access to web pages. Sending all of the certifictes you visit to the CA to verify may be a bigger security risk than being tricked into visiting a web page with an incorrectly issued certificate. Wierd advice IMHO. There are a number of practical reasons for not checking CRLs (Certificate Revocation Lists) all the time, but sending cert serial numbers to the CA is not among them. The serial number is not secret information (neither is the cert itself of course). If you don't trust the CA, then better disable certs entirely, not just CRL checking. poc -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Re: HOW to set “security.OCSP.require” in Google Chrome/Chromium?
On Thu, Mar 24, 2011 at 14:16:49 -0430, Patrick O'Callaghan pocallag...@gmail.com wrote: Wierd advice IMHO. There are a number of practical reasons for not checking CRLs (Certificate Revocation Lists) all the time, but sending cert serial numbers to the CA is not among them. The serial number is not secret information (neither is the cert itself of course). If you don't trust the CA, then better disable certs entirely, not just CRL checking. Sending the serial number to the CA allows the CA to guess (with high probability of being correct) that you are visiting the web page that they sold the certificate for. This information can be resold to other companies for marketing purposes (or other reasons). If there is any money in this, I wouldn't expect Verisign to pass the opportunity up based on other similar stuff they have done. -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Re: HOW to set “security.OCSP.require” in Google Chrome/Chromium?
On Thu, 2011-03-24 at 14:10 -0500, Bruno Wolff III wrote: On Thu, Mar 24, 2011 at 14:16:49 -0430, Patrick O'Callaghan pocallag...@gmail.com wrote: Wierd advice IMHO. There are a number of practical reasons for not checking CRLs (Certificate Revocation Lists) all the time, but sending cert serial numbers to the CA is not among them. The serial number is not secret information (neither is the cert itself of course). If you don't trust the CA, then better disable certs entirely, not just CRL checking. Sending the serial number to the CA allows the CA to guess (with high probability of being correct) that you are visiting the web page that they sold the certificate for. This information can be resold to other companies for marketing purposes (or other reasons). If there is any money in this, I wouldn't expect Verisign to pass the opportunity up based on other similar stuff they have done. Even if that's true, it doesn't belie what I just said. If you don't trust the CA, don't use their services at all. There does not exist, and never can exist, a means of securing communication between two parties that don't trust each other unless they both decide to place some level of trust in a third party. CAs are just one way to do that (and clearly they need to get their act together). Web-of-trust mechanisms are another but I don't know of any mainstream browsers that support them. poc -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Re: HOW to set “security.OCSP.require” in Google Chrome/Chromium?
On Thu, Mar 24, 2011 at 15:12:56 -0430, Patrick O'Callaghan pocallag...@gmail.com wrote: Even if that's true, it doesn't belie what I just said. If you don't trust the CA, don't use their services at all. There is a difference between trusting them to certify a site and to not resell data about you. Some people may trust them for one of these but not the other. But for the record I do remove the certificates in firefox as the certification of some CA who talked a browser manufacturer into including their certs doesn't provide significant weight with me. There does not exist, and never can exist, a means of securing communication between two parties that don't trust each other unless they both decide to place some level of trust in a third party. CAs are just one way to do that (and clearly they need to get their act together). Web-of-trust mechanisms are another but I don't know of any mainstream browsers that support them. Web of trust is better than hierarchical for general use. But also it would be have been nice if browsers were design to help you make sure you are communicating with the same entity as the last time. (Sort of like how ssh does things.) For cert changes, one could sign new certs with the old ones. The current warning system is more like a protection racket that a security system. -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
