Make this plugin the ultimate plugin.

[GoogleCodeExporter]

Now this is #1 on my list and should be on everyones. I would like to see this 
plugin www.cs.cmu.edu/~perspectives/firefox.html implemented in KB SSL 
Enforcer. In addition I would like to see the URL bar turn colors (green for 
payed signed cert, blue for self signed legit cert, red for no https, etc) and 
remove that HTTPS with a dash through that chrome does. Also, if there is a 
site with no HTTP (see Issue 26) then URL bar should turn red or some other 
"this is not encrypted" color and pop up a status bar/message/something that 
reminds us that our data is going over in clear text.

Original issue reported on code.google.com by [email protected] on 7 Oct 2010 at 5:33

[GoogleCodeExporter]

There are multiple things in this:
- Allow self-signed certificates automatically, while still indicating that it 
isn't authenticating the site as with CA signed certificates
- Detect CA fraud where an attacker uses a certificate that's signed by a 
"trusted" CA
- Indicate which level of security you get from a given site in a way that 
makes sense, instead of the traditional "unencrypted is better than 
self-signed" mentality

These are all really good features that I would love to implement. And to be 
honest, I've been wanting to implement these exact features for a while. But I 
don't think it's possible yet to hook into Chrome in ways necessary for these 
features, unfortunately.

I'll try to do some research into what Chrome can and can't do and hopefully at 
least find/create bugs in Chrome for this, so we can follow the issue a bit 
closer. You're of course more than welcome to help out with these things. :)

Original comment by [email protected] on 7 Oct 2010 at 10:02

• Changed state: Accepted
• Added labels: Type-Enhancement
• Removed labels: Type-Defect

[GoogleCodeExporter]

Yea I will grab the source and start to play and hopefully will be able to help 
you out. I already tried to contact the authors but they did not get back to me 
as of yet.

Original comment by [email protected] on 7 Oct 2010 at 11:40

[GoogleCodeExporter]

The extension API for Firefox seems to be quite different from the one in 
Chrome, so I'm not sure if it'll help to look into the Firefox side of it. You 
need the commands to hook into Chrome's certificate management.

Original comment by [email protected] on 8 Oct 2010 at 1:22

[GoogleCodeExporter]

It seems that there are now a few (unresolved) bug reports and an API proposal 
on this subject of extension access to SSL connections:
https://code.google.com/p/chromium/issues/detail?id=49469
https://code.google.com/p/chromium/issues/detail?id=107793
https://sites.google.com/a/chromium.org/dev/developers/design-documents/extensio
ns/proposed-changes/apis-under-development/webrequest-ssl-hooks

Original comment by [email protected] on 18 Feb 2014 at 10:23