Hacker News Reader

Comment by fc417fc802 | Hacker News Reader

I don't believe it's supposed to proactively check the logs as that would inevitably break in the presence of properly configured MITM middleboxes which are present on many (most?) corporate networks.

The point of the logs as I understand it is to surface events involving official CAs after the fact.

View on HN

Clients are supposed to check. For example, Apple requires a varying number of SCTs in order for Safari to trust server certificates. https://support.apple.com/en-us/103214

And yes, it does break MITM use cases, for example on Chrome: https://httptoolkit.com/blog/chrome-android-certificate-tran...

So how does that work with middleboxes? Corporate isn't about to forgo egress security (nor should they).

I don't currently MITM my LAN but my general attitude is that if something won't accept my own root certificate from the store then it's broken, disrespecting my rights, and I want nothing to do with it. Trust decisions are up to me, not some third party.

Corporate managed machines can control the software running on the computer to do anything. I'm not sure the details, but chrome certainly can support corporate MITM. There's likely some setting you have to configure first.

The default should be to reject certificates which aren't being logged, and if you as a user or corporation have a reason to use private certificates, you just configure your computer to do that. Which fully protects against the risk of normal CAs signing fraudulent certificates.

Corporate machines would have the proper certs pushed to them for the MITM box to work though - would that affect this ?

The entire point of transparency logs is to detect a cert issued by a different root CA despite both being trusted. The corporate MITM cert won't be present in the logs by design.

Reply on news.ycombinator.com