Opened 4 years ago

Closed 4 years ago

#17113 closed task (not a bug)

check is it possible to check if a specific CA is intalled in the browser

Reported by: elypter Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

is it possible to do active probing on installed certificates without showing a certificate warning? maybe hidden in an iframe or popup or using webrtc. everything that could load if the certificate is installed and be blocked otherwise.
if possible it could be misused to find out if a user is vulnerable to a hiden mitm attack.
users of goagent, shaddow socks and cooperate content filters could be vulnerable.

Child Tickets

Change History (1)

comment:1 Changed 4 years ago by yawning

Resolution: not a bug
Status: newclosed

Tor Browser doesn't use the system cert store and instead ships with it's own. Any user that alters the preinstalled certificate list in any way is on their own, and should do so understanding the implications thereof.

Note: See TracTickets for help on using tickets.