Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My extension will compare the certificate presented from an external different source (XHR) with the one presented by browser and not allow user to proceed further in case of check failure. Recently, chrome has started detecting proxy and gives user-friendly error messages to "proceed anyway" or "back to safety". Once you accept the risk and click "proceed anyway", Chrome won't ask you again for the same website. I want to achieve effect similar to HSTS sites (completely blocking navigation in case of SSL validation error), but with flexibility to manage my own list. I studied the webRequest (https://developer.chrome.com/extensions/webRequest) and DeclarativeWebRequest APIs but was unable to find anything exposing SSL certificate validation process. In nutshell, something similar to Perspectives addon in firefox but with my own way to trust certificates in Chrome. Google has proposed a draft API couple of years back (https://sites.google.com/a/chromium.org/dev/developers/design-documents/extensions/proposed-changes/apis-under-development/webrequest-ssl-hooks), yet to be made available. Any workaround is appreciated. Thanks in advance.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.