6

I read a lot about security of https and possible MITM attacks lately. For me it seems there is only possible way to make a https-MITM attack: When a MITM exchanges the shipped https-certificate and my computer trusts the signing CA.

So I'm wondering how is it possible for me as user to stay secure? I read about Certificate Patrol for Firefox: http://patrol.psyced.org/ but unfortunately I am using Chrome and moreover the extension is pretty old (from 2011). Is there anything like this for Chrome? I like the idea of some sort of "database" of certificates so I could get a notice as soon as the certificate changes (even if it's exchanged to a new one which I trust).

Would this yield a good security layer?

Thanks!

  • 1
    I just know about this but the IE and Chrome versions are currently WIP: checkmyhttps.net/index.php – Daniel Ruf Jan 1 '16 at 19:56
  • 2
    I don't know if this is still valid/up to date but in 2011 this was specifically marked as "WontFix". Issue 107793: Provide information about the TLS connections to extensions via the webRequest API: >>Possible use cases: - Cert Patrol-style extension that can notify users if a previously encountered certificate has changed.<< – StackzOfZtuff Jan 1 '16 at 23:24
  • @StackzOfZtuff: Latest comment in your link from May 2015 states: "There is explicitly no plan to expose TLS channel binding information (key material extractor, TLS-unique CB). You could synthesize a TLS-server-id CB by massively observing the certificate, but there is zero API guarantee that such a channel will be used to deliver the request, which is why such an implementation has issues." So it seems this is still not possible, thus no such extension existing :( How do YOU make yourself protected in such scenarios? Thanks – tim Jan 2 '16 at 11:50
  • @DanielRuf: Thanks, looks interesting. Hopefully they will release an extension soon :-) – tim Jan 2 '16 at 12:04
  • 3
    @Tim: I've given up. CertPatrol on Firefox drove me nuts. All the certs change all the time. Makes the extension worse than useless for me. If the HTTPS Everywhere extension actually were to incorporate the SSL Observatory feature on Chrome as well at some point in the future (currently Firefox only, I think), I'd activate that. Apart from that: nothing. – StackzOfZtuff Jan 3 '16 at 12:24
2

Is there anything like this for Chrome?

No. Chrome Extensions currently have no way to access information about the TLS certificates being used, and a proposal to add this functionality was rejected back in 2015.

Would this yield a good security layer?

Probably not.

Let's clarify the threat model here: you're concerned about a scenario where "a MITM exchanges the shipped https-certificate and my computer trusts the signing CA". This would require the attacker to obtain a valid certificate from a trusted certificate authority for a domain they do not own.

While CAs have mistakenly issued certificates to the wrong entities in the past (Comodo, WoSign, Symantec), these are pretty rare events, and CAs that consistently fail to uphold the validation requirements in the baseline requirements have their root certificates distrusted by browser vendors. (This happened to WoSign, and is currently happening to Symantec.)

Furthermore, the security benefit that these sort of alerts would provide depends entirely on your response to noticing a modified certificate. Sites change their certificates all the time (often as frequently as once every other month, such as in the case of Let's Encrypt certs managed by Certbot), so the vast, vast majority of the time this alert appears it's just going to be a false alarm. How do you plan to distinguish these false alarms from a legitimate attack? Unless you have some out-of-band way of verifying whether the new certificate you're seeing is legitimate, an alert won't do much.

  • The school I'm attending is now "deep packet inspecting" by basically doing a MITM attack. In this case, knowing when I go to my (own domain/server) webmail that the SSL cert is signed by the schools own certificate vs. the CA I use (or even any other "real" CA) would improve my security. – ivanivan Oct 17 '18 at 14:45
  • @ivanivan Easiest fix for that is to just not install your school's CA, that way your browser will alert you every time they MITM your connection. Or alternately, you could use a VPN or TOR, or write a script that you can run to temporarily trust your school's CA when you're on their network and remove that trust when you disconnect. – Ajedi32 Oct 17 '18 at 15:08
0

Sad, but no. You can use Netcraft extension to avoid phishing webs, or use ESET Smart Security, it has module do detect untrusted SSL certificates. But chrome doest have similar to Certificate Patrol extension.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.