(untitled)

I had a fun idea, replacing the useless "lock" icon with something meaningful: the flag of the country of jurisdiction for the Certificate Authority And a further improvement (not a mess like HPKP) would be allowing the user to "pin" the CA-country to that domain by clicking on it, which would be the only allowable way to enable "glow"-type effects in the URL bar Does this idea seem good, correct, or appropriate?

The lock is not so useless. Some websites does not have https fren. and why would you want to know in which country is something hosted? >inb4 companies that are privacy friendly do you really trust corporations?

flagfox

>>30338 The presence of a flag would tell you the same information as the presence of a lock.

>>30347 The lock tells you "one of the 147 CAs in your trust store approved this connection" The flag would give you some information about WHICH of those it was

>>30341 >>30338 I care less where something is hosted, and more which country could be MITM'ing my connection by fiat Granted, it'll matter less once Certificate Transparency is ubiquitous and surely working well; but I still suspect that there's something to be gained from kick-starting the awareness of CAs and their political vulnerabilities thus

It's a good idea Lainon. The flag should act as an HTTPS indicator AND as WHO is providing encryption.

>>30350 He's not talking about where it's hosted, he's talking about the country of origin listen in the cert. I kind of agree though, I think it would be more useful to show which root CA issued the cert. I've come across phishing sites before and the thing that tipped me off was checking the cert and seeing letsencrypt (not that there's anything wrong with letsencrypt, I just know e.g. my bank doesn't use them).

>>30365 >listen listed

>the flag of the country of jurisdiction for the Certificate Authority utterly useless usual LARP of niggers who dont understand X.509

>>30374 I understand x509. Do you have a specific criticism, or do you not understand the threat model of "threaten CA with shutdown unless they issue some off-the-books 'testing' certs that are used to MITM particular connections"?

>>30365 That was my original idea, though I don't know how well it'd go to offload CA-recognition to the user. At least country flags have not only recognition currently, but also (unlike CA logos) aren't subject to dynamically changing in an environment which I feel like creates some weird incentives I do think that something like "what HPKP could have been" has a lot of potential, too; simply allowing the user to add Trust to known-good states (e.g. first successful bank login at home) to create some auxiliary trust nodes in the chain

Next you will want the browser to pin certificate fingerprints instead of useless link bookmarks, then to actually save pages in a way web archives do it, not the way browsers "save" them. Then you will want Mozilla to start making good software and Google not be evil? Wew, easy on that wrongthink, citizen.

Find the IP address of your domain, then curl it via ipinfo.io. curl ipinfo.io/$(dig a protonmail.com +short) { "ip": "185.70.41.35", "hostname": "185-70-41-35.protonmail.ch", "city": "Plan-les-Ouates", "region": "Geneva", "country": "CH", "loc": "46.1679,6.1166", "org": "AS62371 Proton Technologies AG", "postal": "1228", "timezone": "Europe/Zurich", "readme": "https://ipinfo.io/missingauth" Here's your problem though: Cloudflare

>>30537 I care not about the IP address I happen to be dialing into. MITMers can control that as they please. And that technology already exists [Flagfox add-on] The concern is that my connection gets MITM'd by the government opposing the one I'm operating for, and they spend one of their coerced wildcard-certs from a CA their police/military have physical "jurisdiction" over, and I wouldn't know a thing because my browser treats all CAs as equally trusted with equal scope over all TLDs

>>30365 >the country of origin listed in the cert. Close, but not quite. The certificate can claim the website to be "about" whichever country it pleases; what matters is the country where those administrators responsible for [the systems that] issue the certs physically reside. Given that the browser vendors are supposedly vetting every single one of the CAs, a fact as trivial as this would be no extra administrative burden to document. >which root CA issued the cert This is more on the money, but I think that either augmenting, or outright subsituting the CA's logo with the country where it resides would be more relevant.- e.g. all American CAs have roughly the same threat-model, etc. so knowing "sectigo vs symantec vs …" doesn't matter so much

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest/CertificateInfo hey! good news! it looks like even the "nerfed" FireFox API now allows enough access for this!

>>31143 I've been using firefox since firefox 28 and firefox SUCKS nowadays, now i just use Palemoon goddamn. I don't care about slow JS because i always have it disabled

>>30336 >has idea >glows turn up to sink it seems like a really good idea