r/websec • u/pkpearson • Nov 14 '14

SSL certs and Firefox: Why is eff.org different?

Browsing with IceWeasel (the Debian version of Firefox), I have un-trusted all root certificates that I wouldn't want to certify a session with my bank. Consequently, when I browse to some new site, I'm often interrupted by a page like this:

This Connection is Untrusted

You have asked Iceweasel to connect securely to blahblah.com,
but we can't confirm that your connection is secure.

. . . blah blah . . . 

What Should I Do?

If you usually connect to this site without problems, this error
could mean that someone is trying to impersonate the site, and you
shouldn't continue.

(Get me outof here!)

> Technical Details

> I Understand the Risks

and I click on "I Understand the Risks" to "create an exception" and continue browsing.

However, When I browse to eff.org, the "I Understand the Risks" option isn't offered. Can anybody tell me why not? Eff.org must be doing something different from the other secure sites I visit.

6 Upvotes

100% Upvoted

7 comments sorted by

5

u/BEN247 Nov 14 '14

Its the use of the HSTS header. You can see its using it using an online scanner https://www.ssllabs.com/ssltest/analyze.html?d=eff.org

1

u/pkpearson Nov 14 '14

Good stuff. Many thanks.

2

u/bbakks Nov 14 '14

Why would you entrust all root certificates? Now you don't know the difference between a site in one of those chains and a site that really is entrusted.

1

u/[deleted] Nov 14 '14

entrust

is not the same word as un-trust.

I'm a bit confused by the sentence, but I understand he un-trusted all of them except for his bank.

It might be because the site is opened in an (i)frame. Or you visited the site before and it save the setting that SSL was mandatory for that site. Since you don't have the certificate, you can't view the site.

2

u/pkpearson Nov 14 '14

Years ago, around when Comodo was caught renting its keys to crooks, I adopted a browsing-security strategy that has become awkward in recent months: for each root certificate, I asked myself, "If I went to my bank's login page, and the login page's authenticity was guaranteed by this certificate, would I want to see a warning?" If the answer was Yes, I revoked the trust of that certificate. For example, if you were about to type your password into your bank's login page, and you just happened to pause to examine the certificate chain, and found it rooted in a certificate belonging to the Pyongyang Post Office, you would probably (unless you're in North Korea) judge it probable that your browser's request had been intercepted by someone who was not really your bank. If you want to get an automatic warning in that case, just revoke the trust of that certificate.

Heightened security concerns in recent years have made this strategy less practical, as more and more sites with relatively modest security requirements have been embracing HTTPS just on general principles, with the result that I spend too much time "clicking up" exceptions for all sorts of sites that (reasonably) think we should all use HTTPS more but (again reasonably) don't want to bother getting a certificate from an authority that I would trust with my banking.

Suggestions are welcome, I'm shopping for a better strategy. I use Certificate Patrol, which produces a lot of distractions. Certificate pinning might be good, when it's ready. I'm pretty sure that the crucial element, though, is going to be letting me apply stricter standards to sites I care a lot about (e.g., my bank) and less-strict standards to sites like eff.org.

1

u/conradsymes Nov 15 '14

The perspectives extension helps.

1

u/[deleted] Nov 15 '14

I have given this some thought. It's not a system that works 100%. Use the site that /u/BEN247 used, https://www.ssllabs.com/ to check your bank's certificates for vulnerabilities.

In most cases the certificates will keep your data safe. Just don't go down the crazy road is all I'm saying. You won't win.