Timeline for How can trusting ONE certificate jeopardize everything I do online?
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 31, 2016 at 5:21 | comment | added | dave_thompson_085 | (@IMSop) www.paypal.com www.google.com www.yahoo.com www.microsoft.com www.apple.com all use SAN certs -- although apple has only one name in SAN; the others have many. Also www.oracle.com, though it 301s to plain-http so was harder to check. digicert.com/subject-alternative-name-compatibility.htm (which itself uses SAN) asserts support in almost everything but some older mobile devices. | |
| Mar 30, 2016 at 18:45 | comment | added | watchowl | @IMSoP Nice, thanks for the link! I hadn't seen this in practice before. I've reworded the last part of the answer | |
| Mar 30, 2016 at 18:44 | history | edited | watchowl | CC BY-SA 3.0 |
added 2 characters in body
|
| Mar 30, 2016 at 16:10 | comment | added | IMSoP | @goncalopp If you look carefully, even your example shows an Alt Name in use - you analysed srv.in.ebayrtm.com, but the Subject is srv.ebayrtm.com | |
| Mar 30, 2016 at 16:09 | comment | added | IMSoP | @goncalopp Yes, they really are. Browse to a secure image and check the cert info in your browser, e.g. ir.ebaystatic.com/rs/v/fxxj3ttftm5ltcqnto1o4baovyl.png Or just google "multi-domain certificate" and see how many people are selling them as standard products. Hell, Symantec use one for their own site - check m.symantec.com or test it. | |
| Mar 30, 2016 at 15:18 | comment | added | watchowl | @IMSoP Is ebay actually providing that certificate when visiting any of the SubjectAltName domains? The few ones I tested had different certificates with different CommonNames ssllabs.com/ssltest/… | |
| Mar 30, 2016 at 15:05 | comment | added | IMSoP | @goncalopp How about ebay? ssllabs.com/ssltest/analyze.html?d=www.ebay.com&latest It may be that once upon a time SubjectAltName was poorly supported, but it's now a standard option from most CAs. | |
| Mar 30, 2016 at 14:40 | history | edited | watchowl | CC BY-SA 3.0 |
added 5 characters in body
|
| Mar 30, 2016 at 14:35 | comment | added | watchowl | @IMSoP Can you point me to a website that uses a multi-domain certificate? Maybe I'm misinterpreting your statement. You're absolutely right in that you can accept a certificate with virtually any CommonName. | |
| Mar 30, 2016 at 8:57 | comment | added | IMSoP | @goncalopp In my experience, multi-domain certificates are commonplace and perfectly normal, so I'm not really sure why you're so confident asserting that a certificate is valid for only one domain. Regardless, you can add an exception to the browser for a certificate with the wrong subject name, so it really is irrelevant what the certificate has in it, only what you've opted to trust it for. | |
| Mar 30, 2016 at 0:14 | comment | added | watchowl | @IMSoP A certificate is only valid for a single domain (excepting wildcards, which are valid only on subdomains, and SubjectAltName, which is poorly supported). I'm actually not sure what would happen if you chose to accept a certificate in a domain and then navigated to another domain which was included in SubjectAltName - do you have any reference? | |
| Mar 30, 2016 at 0:05 | comment | added | watchowl | @AndrewSavinykh Correct. What's interesting is that browsers make a huge fuss when you visit a site with a invalid server certificate, but for firefox the dialog to add a CA is quite inconspicuous. Try this link (but don't actually add it if you don't trust them) | |
| Mar 29, 2016 at 13:18 | comment | added | IMSoP | In fact, when manually trusting a cert, none of the details need be valid - it can be expired, self-signed, and have a CNAME for example.com, but still be used for encryption. Suggested wording for last para: "No. These are server certificates, and you have only trusted them for a specific domain. If another website uses the same certificate, your browser will reject it unless you add another exception." | |
| Mar 29, 2016 at 13:10 | comment | added | IMSoP | Although most server certificates certify only one site, there is no restriction on what they can list. The distinction is not that you are trusting a single-server certificate, but that you are adding a single-server exception in the browser - the same self-signed certificate used on a different domain would require a separate exception to be added. Otherwise, a site could persuade you to trust their self-signed cert, then use it to MITM every site you visit. | |
| Mar 29, 2016 at 12:01 | comment | added | Andrew Savinykh | If a web site can trick you into installing their cert into trusted root (as opposed to just trusting this particular cert) you might be compromised on more than just their website. Is this correct? | |
| Mar 29, 2016 at 7:35 | vote | accept | Ulkoma | ||
| Mar 29, 2016 at 7:35 | history | edited | Ulkoma | CC BY-SA 3.0 |
added 2 characters in body
|
| Mar 28, 2016 at 20:57 | history | answered | watchowl | CC BY-SA 3.0 |
