#tlsnotary-chat

Quo Vadis EV SSL

ok i had that provider untrusted in my root store. it might be to do with me having killed a lot of root CAs out of paranoia.

so basically i'm reasonably convinced that cert is OK.

ok, so it redirects to online-business.co.uk

(tsb(

but .. i thought we'd already dealt with this, perhaps not

any suggestions on me verifying the contents? :)

anyway i'll look now at how easily you can do this manually

yeah i know, i had to just finish that

cool

pagesigner-browserless *ought* to be a way to do this

BB-Martino: it's going to be this one probably: https://github.com/AdamISZ/taas-poc-1-auditee/b...

I'll just try it with some random pgsg

param 1 = pgsg ?

it says 'invalid file format'

yeah i just got the same

it's an old file format, will need to push a fix

old file format? the auditee has only heard of pagesigner first yesterday

surely they used the latest version

oh, or you mean the .py you pasted just now?

sup

BB-Martino: yes, that auditor.py file is from a couple of months back

but it's the best fit to what you need

i just have to updated it.

give me an hour, should be about that long

if it's of use to anyone, my certs are apparently stored under .mozilla/firefox/<random string>.default/cert8.db

all righty. please pm me when done, thanks

BB-Martino: git pull browserless branch of AdamISZ/taas-poc-1-auditee and run tlsnotary-auditor.py as before, should work now.

notes: 1, of course I don't intend you to have to use a separate repo for this, will integrate it into pagesigner-browserless which is supposed to contain the tools you need to use pagesigner without JS.

2, this currently ignores the server name field, and just prints out the cert fingerprint to the domain file. this should be fixed.

where's the git again?

it's a result of the fact that dansmith streamlined the notarization file format, previously it stored the server name and modulus inside it, now it only stores the raw DER format, so i have to do some parsing

well, https://github.com/AdamISZ/taas-poc-1-auditee/

i know it's a total pain having a different repo, i just knew it was somewhat time critical

if it works you should see:

still says invalid file format

-rw-rw-r-- 1 browser browser 7758 Jun 5 15:07 tlsnotary-auditor.py

is that the right size?

do git fetch to get the update

from the browserless branch

and checkout browserless

git clone https://github.com/AdamISZ/taas-poc-1-auditee.git

is what i did

and went under src/auditee

yes that's right

sorry i'm a bit of noob with this, let me know if i should be doing something different

it takes the master branch by default

so do git fetch

then do git checkout browserless

and yes, the filesize is bigger than that now, 9K

sorry, i'm confused plus haven't slept a lot, what do i enter :)

yes i know it's a pain, i didn't intend it, it's just getting it up and running properly will take time

git fetch

git checkout browserless

cd src/auditee

python tlsnotary-auditor.py <filename>

befor git fetch what?

should see:

Notary pubkey OK

Notary signature OK

Commitment hash OK

HTML decryption with correct HMACs OK.

Audit passed! You can read the html at:

start from the beginning

you already did git clone

oh, i deleted that

hold on

then cd taas...*

then the above

back in a minute

thanks. sorted.

so what's the upshot? can you run it as above?

BB-Martino: ^

yes, it extracted the decrypted page, thanks

ok, good. the messages tell you what was checked OK. I'm working on getting the server name extracted so in principle you'll again be able to cross check the domain name against the certificate pubkey

of course it still leaves this whole big issue of cert verification being flaky.

asn1 is basically insane :)

waxwing: the great thing about mac check is that if it breaks, it will fail

so we can just pull all the tricks, shenanigans, hacks, to make it pass

proslogion: i don't quite follow

if it passes then the authenticity is assured

yes, i got that part, but don't understand what you mean by 'pull all the tricks'

to sum up: there won't be false positives, so if it works, then we do it right somehow

friends don't let friends parse asn1

if it were not crypto, then false positives can happen for all kinds of reasons

proslogion: sure, but it's orthogonal to whether (a) the notary sig is valid, (b) the server cert is trusted.

i think the set of checks we do is both necessary and sufficient

i am just saying, people can use it as long as it works, stability state is not ideal, but security is still guaranteed

ok you're talking about that asymmetry, yes, i have always found that comforting

yes we'll never get a fake notarization passing tests.

server_name = rv[0].getComponentByPosition(0).getComponentByPosition(5).getComponentByPosition(4).getComponentByPosition(0).getComponentByPosition(1)

i guess it might be time to write an alias for this function :)

Ouch

omg hypercube

quick, call vbuterin

BB-Martino + anyone else using it:

https://github.com/tlsnotary/pagesigner-browser... <-- updated README with new details, please read

this repo now contains notarize, auditor and parse-pgsg

so you can do all the basic functions notarize, extract html, extract certs, check oracle , from outside browser

so BB-Martino you no longer need that temporary repo we used today, the auditor script will be kept just in that pagesigner-browserless repo

thanks

it will be nice to not have to worry about any of 10 bugs hitting me and preventing me from verification

command line ftw

it now outputs the server name into domain_data.txt too, so it should be giving you what you had before with tlsnotary

yeah auditors are prob better off on the command line, i agree.