3

HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection more complicated (some sites would simply not accept the connection so there is nothing to inspect).

It seems however (from the Wikipedia page) that

Most browsers disable pinning for certificate chains with private root certificates to enable various corporate content inspection scanners[6] and web debugging tools (such as mitmproxy or Fiddler). The RFC 7469 standard recommends disabling pinning violation reports for "user-defined" root certificates, where it is "acceptable" for the browser to disable pin validation.[7]

So no protection anymore against deep inspection (I am not sure what the mechanism is for in that case but anyway).

This probably does not matter anymore taken that

The mechanism was deprecated by the Google Chrome team in late 2017 because of its complexity and dangerous side-effects. Google recommends using the Expect-CT as a safer alternative

Certificate Transparency is a public log of issued certificates

enter image description here

My questions:

  • How does this log help to ensure that the certificate I see is the one actually presented by the target site, and not an intermediate one (where my session is terminated on the deep inspection engine, which replays the connection)
  • If it indeed helps to do that, how does the "enterprise" restriction highlighted for HPKP above comes into play (if at all)?
Improve this question

1 Answer 1

Reset to default
3

The aim of certificate pinning is to protect against malicious man in the middle attacks and not against legal content inspection as done in companies and also desktop antivirus for protection, where the certificates are issued by an explicitly trusted local CA. it does not matter here that legal protection methods might also be used to invade the privacy - you need to discuss such things with your employer instead.

Insofar it makes sense to handle Expect-CT the same way and it is also documented to behave that way. From MDN: Expect-CT:

Root CAs manually added to the trust store override and suppress Expect-CT reports/enforcement.

Improve this answer
1
  • It seems a bit disturbing that Expect-CT is suppressed by the presence of a 3rd-party root -- this prevents the browser from tattling poorly-executed attempts by an actual internal network attacker to a reporting server specified by the TLS terminator, as well as totally denying the report capability from any site genuinely using a "3rd-party" root such as CAcert or the United States Government...
    – JamesTheAwesomeDude
    Commented Jan 13, 2023 at 22:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .