5

I have a few self-signed certificates that I use, and I find it tedious comparing the entire hex value of the hash when accepting it in a new location. To be honest I usually just look at the first couple or the last couple digits. If it were in some kind of visual form like gravatars are in, I feel like I would more easily identify whether or not they are correct.

I should probably be copying the certificates across as files and installing them rather than manually checking the hash and then accepting them but it is just so much easier to simply accept them sometimes.

Probably if it's something a human can identify right away visually, then there's not enough entropy to be very confident in its identity. I am just wanting a better way than looking at the first couple digits to bridge a bit of the gap between what's convenient and what's truly secure.

Is there any merit to the idea of certificate viewing software showing a gravatar/identicon for the hash of an SSL certificate, to aid in identifying it?

Improve this question
1

1 Answer 1

Reset to default
6

Is there any merit to the idea of certificate viewing software showing a gravatar/identicon for the hash of an SSL certificate, to aid in identifying it?

Yes. At least with OpenSSH this has been done. I don't see why it wouldn't work with SSL as well. But I know of no (live) implementation. There was a thesis from 2004 that showed an implementation of this for Mozilla, but I don't think it was more than a proof of concept. (See "Further reading" section.)

OpenSSH calls these images "RandomArt", "SSH Fingerprint ASCII Visualisation", "Visual fingerprint", "Visual Host Key". They have been there since version 5.1 from 2008. But I've only ever seen these images when creating a new key. Not when actually using one with ssh. (And that's because it's off by default on all ssh clients I've come across. You need the -o VisualHostKey=yes option.)

Further reading

Improve this answer
4
  • Two more suggestions here: security.stackexchange.com/a/90610/61443
    – Mike Ounsworth
    Commented Jun 1, 2015 at 15:17
  • 1
    Does someone already suggested to be implemented in a browser, beside the one cited? Some browser, like Chrome, could show it when users click "Advanced" on a SSL error. Maybe also show a button to permanently trust the certificate ( like Mozilla do ) when it repeats after some time. Of course it needs to be disabled when HSTS is used.
    – Gustavo Rodrigues
    Commented Jun 11, 2015 at 14:20
  • @GustavoRodrigues: No. I don't know any.
    – StackzOfZtuff
    Commented Jun 11, 2015 at 14:35
  • @GustavoRodrigues, that was basically what i was thinking could happen, or perhaps for plugins to be developed.
    – Nacht
    Commented Jun 12, 2015 at 1:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .