[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #13410 [Applications/Tor Browser]: Disable self-signed certificate warnings when visiting .onion sites
#13410: Disable self-signed certificate warnings when visiting .onion sites
--------------------------------------------+------------------------------
Reporter: tom | Owner: pospeselr
Type: defect | Status: needs_review
Priority: Very High | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: ux-team, TorBrowserTeam202003R | Actual Points: 7
Parent ID: #30025 | Points:
Reviewer: | Sponsor:
| Sponsor27-must
--------------------------------------------+------------------------------
Comment (by pospeselr):
So I took some time today and yesterday to investigate what it would take
to implement alecmuffet's SOOC spec (which is basically a superset of the
posted patch with additional limitations). It actually wouldn't be too
terribly tricky to do and this is the general plan I'd follow to do so:
> implement a new OnionTrustDomain that implements 1.1 through 1.6 in the
SOOC spec
> - {{{OnionTrustDomain : public NSSCertDBTrustDomain {}}}}
> - override {{{GetCertTrust}}} and have the implementation first call
{{{NSSCertDBTrustDomain::GetCertTrust()}}}, and only on Success override
the {{{trustLevel}}} to {{{TrustLevel::Anchor}}} (some cert revocation
checks happen here by default which I think we should *probably* keep)
> - override {{{IsChainValid}}} and have implementation first call
{{{NSSCertDBTrustDomain::IsChainValid()}}}, and only on Success perform
the additional checks on our cert listed in the SOOC spec
> in {{{CertVerifier::VerifyCert()}}, use the new {{{OnionTrustDomain}}}
in a branch within the {{{case certificateUsageSSLServer:}}} block when
{{{hostname}}} is an onion.
SOOC spec: https://github.com/alecmuffett/onion-dv-certificate-
proposal/blob/master/text/draft-muffett-same-origin-onion-certificates.txt
Some previous discussion alecmuffet has had with Mozilla devs:
https://docs.google.com/document/d/1xE5eaDMiOKphDxijK9tfIWHUB-h-fTG8tb3laofXLSc/edit#
Overall the new patch should be straight forward, with the bulk of the new
checks living in {{{OnionTrustDomain::IsChainValid()}}}.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13410#comment:40>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs