Mozilla Firefox - Feature Against SSL-certificate Fraud

[mrdos622]

Mozilla Firefox is considered a secure web browser. But what if an intermediate SSL Authority was forced to issue and has issued a valid duplicate SSL-certificate, and your traffic is being redirected by ISP to a surveilling server?

To combat such SSL fraud, I propose a new Firefox feature which:

• Collects fingerprints of each validated SSL-cert into a Firefox SSL List (fingerprint, date of expiration, issuer and host name) of any host a user connects to and any website s/he visits.
• While browsing, if a fingerprint accidentally changes, as compared against the Firefox List, the app should block the connection and show a pop-up window informing that the particular SSL-certificate does not match with one existing in the Firefox List (e.g., fingerprint changed, different issuer); so accept the risk and continue or not?
• Firefox settings should have configuration options which would allow for managing the Firefox List of SSL-certs collected while browsing various websites, displaying host names, fingerprints, issuer names, and dates of expiration. There should be a setting for strict or permissive collection of the fingerprints on first visiting of websites (first connection to hosts). And some other flexible and convenience options, such as asking what to automatically do when the certs do not match while browsing.
• The settings should also allow to enforce this security feature for either specific listed sites (those requiring extra security by the user choice) or for all hosts.

[Jon]

Thanks for submitting an idea to the Mozilla Connect community! Your idea is now open to votes (aka kudos) and comments.