- The EFF has released a new version of HTTPS Everywhere, which includes a nifty 'Decentralized SSL Observatory' feature. This scans for unusual certificates (e.g., MITM certs, certs with weak keys) and reports them back to EFF for logging. A very nice step towards a better 'net.
- StalkR reminds me that Chrome 18 includes support for Public-key Pinning. This is an HTTP extension that allows a site operator to 'pin' their site to one (or more) pre-specified public keys for a given period of time. A pinned browser will reject any alternative keys that show up -- even if they're embedded in a valid certificate.
- A couple of readers point out that popular sites (e.g., Google and Facebook) change their certificates quite frequently -- possibly due to the use of load balancers -- which poses a problem for "carry a list of legitimate certs with you" solutions. I recognize this. The best I can say is that we're all better off if bogus certs are easy to detect. Hopefully site operators will find a compromise that makes this easy for us.