Gmail and SSL
Steven Bellovin
smb at cs.columbia.edu
Thu Jan 3 00:29:05 UTC 2013
On Jan 2, 2013, at 7:15 PM, Randy Bush <randy at psg.com> wrote:
>> Do you run Cert Patrol (a Firefox extension) in your browser?
>
> yes, but my main browser is chrome (ff does poorly with nine windows and
> 60+ tabs). there is some sort of pinning, or at least discussion of it.
> but it is not clear what is actually provided. and i don't see evidence
> of churn reporting.
>
Google uses certificate pinning for a very, very few sites. From http://blog.chromium.org/2011/06/new-chromium-security-features-june.html :
In addition in Chromium 13, only a very small subset of CAs have the
authority to vouch for Gmail (and the Google Accounts login page).
You can turn it on for other sites but:
Advanced users can enable stronger security for some web sites by
visiting the network internals page: chrome://net-internals/#hsts
You can now force HTTPS for any domain you want, and even “pin” that
domain so that only a more trusted subset of CAs are permitted to
identify that domain.
_It’s an exciting feature but we’d like to warn that it’s easy to break
things! We recommend that only experts experiment with net internals
settings._
Emphasis theirs.
The only Chrome browser I have lying around right now is on a Nexus 7 tablet;
I don't see any way to list the pinned certs from the browser. There is a
list at http://www.chromium.org/administrators/policy-list-3, and while I
don't know how current it is you'll notice a decided dearth of interesting
sites with the exceptions of paypal.com and lastpass.com.
--Steve Bellovin, https://www.cs.columbia.edu/~smb
More information about the NANOG
mailing list