Does anyone know if it's possible to write a Firefox add-on that could warn you that the site you're connecting to uses one of these less trustworthy or esoteric CAs? I've looked through the APIs, but I don't see any hooks for that kind of info.
EDIT: Now that I think about it, it must be possible, Certificate Patrol is looking at the cert info, I'll see how they do it.
Since I don't browse Chinese websites I just distrusted the WoSign root and used the Red Jacket add-on[0] to distrust their intermediate certs (at least some of which are cross-signed by other trusted CAs).
If someone shady was MITMing your traffic, they could just block access to the API. If you wanted to do the checks before loading each URL, it would make things very slow.
To some extent this would provide a false sense of security, as if the CA misissues a certificate it wouldn't stop it from being used to hijack your session with an iframe.
Comments
Does anyone know if it's possible to write a Firefox add-on that could warn you that the site you're connecting to uses one of these less trustworthy or esoteric CAs? I've looked through the APIs, but I don't see any hooks for that kind of info.
EDIT: Now that I think about it, it must be possible, Certificate Patrol is looking at the cert info, I'll see how they do it.
Since I don't browse Chinese websites I just distrusted the WoSign root and used the Red Jacket add-on[0] to distrust their intermediate certs (at least some of which are cross-signed by other trusted CAs).
[0] https://addons.mozilla.org/en-US/firefox/addon/red-jacket/ (this is necessary since there's no built-in UI in Firefox to distrust intermediate certificates: https://bugzilla.mozilla.org/show_bug.cgi?id=585352)
You could probably use the website URL + an API (such as https://www.ssllabs.com/projects/ssllabs-apis/)? There might be a better way, though.
If someone shady was MITMing your traffic, they could just block access to the API. If you wanted to do the checks before loading each URL, it would make things very slow.
To some extent this would provide a false sense of security, as if the CA misissues a certificate it wouldn't stop it from being used to hijack your session with an iframe.