2

If you download a friend's site's unique HTTPS root certificate (independent of default browser-shipped ones), or you simply make a 'permanent exception' to an obscure self-signed cert, in Firefox, I wonder whether or how an attack by third parties (server-level and on the HTTP application layer) to discover the usage and storage of this unique and obscure HTTPS cert / authority, by you as a user on the web, is possible.

If discoverable by other servers or MITM who somehow use those same unique certs to check against your lookup / verification / browser response to them (if you have already accepted the same cert surely the timing will be quicker), they can then attack your privacy by knowing you use (or at least have accepted/installed) the aforementioned cert from your friend's site, or break anonymity via the concept of fingerprinting (only targeted fingerprinting).

What would be various ways for doing this, and the requirements for those methods? I am no security researcher, but can think of 1. server-side direct cert forging (but would that require acquiring my friend's private keys and thus less likely of a broad threat?), and 2. (but blockable by add-ons such as RequestPolicy if the user is aware), using cross-site requests involving the original friend's site without any impersonation/stealing/forging needed anyway, and somehow observing whether indeed, you have installed, or accepted that cert in this way.

If there are differences between browsers in such vulnerability, I use Firefox.

  • 1
    If an attacker knows the domain associated with that certificate, they can test if your browser accepts it or not. – CodesInChaos Feb 12 '15 at 8:22
1

There is no chance for fingerprint attack.

The first point here is there is no unique certs as you can create and if you try to make it , you need to add digital signature in the certificate( self signed or not ), then you require private key. Its available only with the particular person.

The second point here is you can't establish a secure communication, it will obviously fail during the negotiation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.