3

So I've been looking for an answer to this one but no one seemed to have asked this before. As far as I understand, when connecting to a website. The browser sends a query to an OCSP server to verify the current validity of it's ssl/tls certificate. It also queries a service to check if the website is malicious ("block reported attack sites" on firefox) What came to mind is, does this not pose a privacy issue? If every site I visit is passed along to some server to check whether it is malicious/has a valid certificate?

I am aware of the fact that SSL root CA's are stored locally, but the validity of the website's certificate sure isn't.

3

The browser sends a query to an OCSP server to verify the current validity of it's ssl/tls certificate.

Yes, with OCSP the OCSP could figure out which site the user visits. It cannot figure out which URL but it can determine the certificate the browser tries to access and thus which site. OCSP requests are not done for each HTTPS request to the same site but the response is cached for some time. Some server periodically get the OCSP response from the OCSP responder and send it together with the certificate (OCSP stapling). In this case the browser does not need to query the OCSP responder itself which is a good thing for privacy and also for performance. Apart from that the Chrome browser does not make use of OCSP anymore but instead has there own curated list of revoked certificates. Not everybody agrees that this is really the better way.

It also queries a service to check if the website is malicious ("block reported attack sites" on firefox)

Initial versions of this feature (Google Safebrowsing) checked each site by asking a central server but this was long ago. Today a local database is updated regularly and checks are done offline against this database. Only if this offline check indicates that the site might be malicious it will go online and verify this with the central server. Thus this feature is no longer much invasion of privacy.

But there several firewall/antivirus products still behave this way and send unknown URL's to the firewall vendor which then makes another access to analyze the potentially malicious site. Some vendors even go as far as selling these profiles to interested parties like advertisers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.