Convergence Protects Against Fraudulent Web Security Certificates

Recent problems with certificate authorities have exposed major problems with the trustworthiness of Web browser security. Rather than simply trusting a signed SSL certificate, Convergence, a free Firefox extension, checks with several trusted certificate sites, or notaries. If all of the notaries agree that the certificate is accurate, Convergence gives the go-ahead to use the site.

Jim Rapoza

November 3, 2011

5 Slides

The recent hack of the DigiNotar certificate authority has brought to light a major weakness in the underlying security architecture of the Web.

Almost all secure Web communications rely on SSL (Secure Sockets Layer) and the certificates used to verify the authenticity of the sites you are visiting. But if a certificate authority is compromised, all of that security and assurance of authenticity goes out the door. Browser makers and operating system vendors have been issuing updates to block fraudulent certificates that were issued through the DigiNotar hack. But what if there had been a way to flag the problems with the fraudulent DigiNotar certificates as Web surfers ran into them?

That is exactly what Convergence, a free Firefox extension, attempts to do. Rather than simply trusting a signed certificate, Convergence checks with several trusted certificate sites, or notaries. If all of the parties agree that the certificate is accurate, it's OK to go ahead and use the site. However, if the notaries detect a difference between what they have as valid certificates and what the browser is seeing, then the certificate will be flagged and the user can avoid that site.

Convergence is developed by well-known security researcher Moxie Marlinspike and is based on the principles of network perspective created by the Perspectives Project at Carnegie-Mellon. Interestingly, this group also has its own Firefox extension that is similar to Convergence.

Using Convergence is very simple. You simply go to the main Convergence site at and install the extension to your Firefox browser. The extension is then added to your Add-Ons directory, and Convergence adds a button to the upper-right corner of the browser window. Clicking on the button makes it possible to temporarily disable Convergence and to define the Options for the extension. The main setting in the options is to define the notaries that you want to trust. The tool comes with a few pre-defined notaries, and the idea is that, over time, more will become available. Advanced options settings let users define caching, whether they would anonymously communicate with notaries and what the threshold to verify a certificate is (such as notary consensus, majority or verification from just one notary).

In my evaluation, Convergence was pretty seamless. I did run into a few problems when using enterprise Web applications for business, where some tasks wouldn’t complete while Convergence was enabled. Using the button to temporarily disable Convergence solved these issues.

About the Author(s)

Stay informed! Sign up to get expert advice and insight delivered direct to your inbox

You May Also Like

More Insights