[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-bugs] #5789 [Website]: Provide gpg-self-signed SSL certificate to enable meaningful certificate pinning

#5789: Provide gpg-self-signed SSL certificate to enable meaningful certificate
pinning
-------------------------+--------------------------------------------------
 Reporter:  vinsci       |          Owner:  phobos
     Type:  enhancement  |         Status:  new   
 Priority:  normal       |      Milestone:        
Component:  Website      |        Version:        
 Keywords:               |         Parent:        
   Points:               |   Actualpoints:        
-------------------------+--------------------------------------------------
 I suggest publishing a GPG-self-signed SSL certificate for the website, in
 order to enable meaningful certificate pinning.

 To avoid forcing ignorant users to have to deal with warning messages for
 the self-signed certificate, the GPG-self-signed SSL version of the
 website would be published on a different port number, and so the standard
 SSL port number can continue to serve the SSL CA-signed (but therefore
 less trusted) content.

 An attacker on Tor users in a country may succeed simply by modifying web
 site documentation (via on the fly certificate rewriting) to give the
 wrong advice. It matters little then that the software itself is GPG-
 signed.

 For a website example, the https://dev.mutt.org/trac/ website utilizes a
 GPG-self-signed SSL certificate (but doesn't provide a CA signed
 certificate). See description on that page.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5789>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs