Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My extension will compare the certificate presented from an external different source (XHR) with the one presented by browser and not allow user to proceed further in case of check failure. Recently, chrome has started detecting proxy and gives user-friendly error messages to "proceed anyway" or "back to safety". Once you accept the risk and click "proceed anyway", Chrome won't ask you again for the same website. I want to achieve effect similar to HSTS sites (completely blocking navigation in case of SSL validation error), but with flexibility to manage my own list. I studied the webRequest (https://developer.chrome.com/extensions/webRequest) and DeclarativeWebRequest APIs but was unable to find anything exposing SSL certificate validation process. In nutshell, something similar to Perspectives addon in firefox but with my own way to trust certificates in Chrome. Google has proposed a draft API couple of years back (https://sites.google.com/a/chromium.org/dev/developers/design-documents/extensions/proposed-changes/apis-under-development/webrequest-ssl-hooks), yet to be made available. Any workaround is appreciated. Thanks in advance.

share|improve this question
    
I have seen a chrome add on using this info - it's part of the required data needed to support the FIDO protocol. So yes - this is does already exist. Sorry I forget the name of the product that uses it already. –  cnd May 26 at 9:19
    
This extension functionality seems quite similar to the SSL Observatory provided by EFF's HTTPS Everywhere extension, ie. send the certificate to the SSL Observatory which in return will provide a warning if there is anything suspicious which could indicate a MiTM attack (plugin available for Chrome, Firefox, Firefox mobile, Opera). –  WhiteWinterWolf May 26 at 9:29

1 Answer 1

No, and it doesn't seem likely to be added as a feature. See https://code.google.com/p/chromium/issues/detail?id=107793#c20

I'm just deeply concerned about the code complexity cost here, which increases the opportunity for both performance and security bugs. - rsleevi@chromium.org

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.