8

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My extension will compare the certificate presented from an external different source (XHR) with the one presented by browser and not allow user to proceed further in case of check failure. Recently, chrome has started detecting proxy and gives user-friendly error messages to "proceed anyway" or "back to safety". Once you accept the risk and click "proceed anyway", Chrome won't ask you again for the same website. I want to achieve effect similar to HSTS sites (completely blocking navigation in case of SSL validation error), but with flexibility to manage my own list. I studied the webRequest (https://developer.chrome.com/extensions/webRequest) and DeclarativeWebRequest APIs but was unable to find anything exposing SSL certificate validation process. In nutshell, something similar to Perspectives addon in firefox but with my own way to trust certificates in Chrome. Google has proposed a draft API couple of years back (https://sites.google.com/a/chromium.org/dev/developers/design-documents/extensions/proposed-changes/apis-under-development/webrequest-ssl-hooks), yet to be made available. Any workaround is appreciated. Thanks in advance.

Improve this question
2
  • 1
    I have seen a chrome add on using this info - it's part of the required data needed to support the FIDO protocol. So yes - this is does already exist. Sorry I forget the name of the product that uses it already.
    – cnd
    May 26, 2015 at 9:19
  • 1
    This extension functionality seems quite similar to the SSL Observatory provided by EFF's HTTPS Everywhere extension, ie. send the certificate to the SSL Observatory which in return will provide a warning if there is anything suspicious which could indicate a MiTM attack (plugin available for Chrome, Firefox, Firefox mobile, Opera).
    – WhiteWinterWolf
    May 26, 2015 at 9:29

2 Answers 2

Reset to default
6

No, and it doesn't seem likely to be added as a feature. See https://code.google.com/p/chromium/issues/detail?id=107793#c20

I'm just deeply concerned about the code complexity cost here, which increases the opportunity for both performance and security bugs. - [email protected]

Improve this answer
1
0

This may be available in Chrome Development Tools Network.SecurityDetails. which provides security details about the request.

https://chromedevtools.github.io/devtools-protocol/tot/Network/#type-SecurityDetails

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .