2

I've just installed the Perspetive addon in firefox.

When I'm vistit, for example google, Perspective says the following message:

Warning: Perspectives has NOT seen this certificate consistently.

What does that mean? Is my connection secure or what?

How can I make sure of that my SSL-encryption is secured and not faked?

I have compared the fingerprints from different sites, like google and facebook, and there are not the same. Is that Ok?

Improve this question

1 Answer 1

Reset to default
2

The Perspective addon does distributed certificate pinning. Certificate pinning means to associate a particular certificate to a particular host, so that any changes can be noted. This is mainly to help prevent man-in-the-middle (MITM) attacks.

For example, say that when you visit https://www.eff.org/ on Monday, the security certificate for that site was issued by Comodo, with an expiry date of 2017. Certificate pinning software would alert you if you visit the same site on Tuesday, but this time the certificate is from TeliaSonera.

Distributed certificate pinning means that various different devices around the world collaborate to compare the certificates that they have each seen, thus making it extremely difficult for a MITM attack to go undetected.

Perspectives is configured to have a threshold of "disagreement", and will show a warning if a certain number of notary servers disagree, are unresponsive, or can't be contacted.

From their Firefox Extension page:

If your local network uses a proxy or firewall to access the Internet, it may prevent Perspectives from reaching notaries. As a result, all sites will fail verification

In this case, I've done a quick test. The default threshold is 75%, and there are 10 notaries in the default list. At the moment, 3 of those notaries don't seem to be responding. Therefore even if all 7 working notaries agree, you only have 7/10 = 70% agreement, which is below the threshold.

enter image description here

This means that by default, every HTTPS site will cause a "Perspectives has NOT seen this certificate consistently" warning. I tested with 7 HTTPS sites and got the warning for every single page.

So my take on this is:

  • Your connection is probably secure and not faked.

  • The error is probably transient caused by a combination of default settings that err on the side of caution, and what may be temporary issues with the default notaries.

  • The fingerprints from different sites should be different, as each certificate has a different fingerprint.

I would suggest reducing the "Percentage of notaries that must agree" setting to 60%, which still gives good protection and does not cause this false alarm.

Improve this answer
2
  • Thank you very much. I have another question. When I visit, for example, my bank, it says that the Owner is Swedbank, besides the lock in the URL. But when I'm visiting for example facebook or google, and clicks on the lock and then More information, it says: Owner: This website does not supply ownership information. It is the same thing with Facebook. Do I need to worry about this?
    – user500468
    Commented Apr 8, 2014 at 12:23
  • Browsers display a bit more information when an Extended Validation Certificate is used, as you observed on Swedbank. The text you're reading comes from the way Firefox handles the User Interface for non-EV sites, which I think is a bit misleading. The certificate still works and does in fact validate ownership (CN = *.facebook.com), it's just not an EV certificate (which are more expensive). So you don't have to worry.
    – scuzzy-delta
    Commented Apr 8, 2014 at 12:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .