Hacker News Reader

> Now that's a different question. While having access to the certificates is no problem at all, being able to create a new certificate for an arbitrary website allows one to pretend to be that website. The only defense against it is that, if a CA is caught issuing these certificates, it risks being removed from the browser's trust lists, which is a death penalty for a CA's business. Also, there is a new initiative (Certificate Transparency) to make it easier for these certificates to be caught.

There is a defense against rogue CAs: HTTP Public Key Pinning (HPKP) [0]. Chrome, Firefox et al use a HPKP preload list, but unlike with Strict Transport Security (HSTS) there currently appears to be no way to submit one's own site for inclusion in the preload lists. See e.g. Mozilla's policy [1].

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key...

[1] https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...

As well as what rhblake said, it's also always worth remembering a core aspect of all this: a lot of general authentication discussions are concerned with the extremely important issues of public scalability and ease-of-use, which is where things like the standard CA system come into play, but those don't necessarily need to apply for someone's own specific instance. So in this case:

>are there ways for me to know when my own browsing is truly private between myself and only the party at the other end, and not other curious or intrusive uninvited third parties?

Yes, you can use a side-channel. At that point it's just a tradeoff between how much effort you want to/can expend vs what value is at risk. At the simplest and easiest, this could just plain mean giving them a call (or message or even snail mail) and spending a few seconds having them verify what the certificate signature should be. Or for that matter talk to a few other people at geographically distinct locations and ask what they see. Combined with pinning (or manual trust/locking or whatever depending on your tool) merely knowing you've got the right cert and will be alerted if it changes may be all that's required and immensely raises the time/resource/expertise cost for any potential attacker. For more effort and a higher level of security, people can flat out physically exchange certs/keys (or even pure entropy) and bypass any 3rd party authentication involvement entirely. It's easy to make one's own entire CA architecture in fact, all the tools are freely available for all. It's the general sharing and trusting that is the stick wicket, but within the bounds of an existing trust relationship it's much more straightforward.

Obviously this is all more work then just going to a URL and seeing if it has a green lock, or CT or anything else, and because it's work each time it's unrealistic to expect the general population to do so in general. But if someone specifically needs communications to be "truly private between myself and only the party at the other end" then it's achievable by trading in more upfront setup work, and always has been. Much of the ongoing development and research and marketing efforts are about trying to raise the universal floor level, but everyone is free to exceed that if necessary.

You can also use the Perspectives plugin to have other servers check the certificate.

https://perspectives-project.org/