Slashdot Log In
Firefox SSL-Certificate Debate Rages On
Posted by
kdawson
on Fri Aug 22, 2008 07:27 AM
from the four-screens-i-mean-really dept.
from the four-screens-i-mean-really dept.
BobB-nw points out the ever more raucous debate over the way Firefox 3 handles self-signed certificates. The scary browser warnings have affected a number of legitimate sites (such as Google AdWords and LinkedIn) that didn't renew certs in time. Lauren Weinstein loudly called attention to the problem early in July. "If you visit a website with either an expired or a self-signed SSL certificate, Firefox 3 will not show that page at all. Instead it will display an error message... To get past this error page, users have to go through four different steps before they can access the website, which from a usability standpoint is far from ideal. This way of handling websites with expired or self-signed SSL certificates is bound to scare away a lot of inexperienced users, no matter how legitimate the website is."
Related Stories
Submission: Firefox SSL-certificate debate gets gnarly by Anonymous Coward
[+]
IT: Browser Extension Defeats Internet Eavesdropping 194 comments
Pickens writes to tell us that researchers at Carnegie Mellon University have created a simple system to help prevent man-in-the-middle attacks. Using a preset list of friendly sites called 'notaries,' the new 'Perspectives' system helps users to authenticate sites that require secure communications. Additionally this should help with the recently debated solution implemented by Firefox that has so many users frustrated and confused. "By independently querying the desired target site, the notaries can check whether each is receiving the same authentication information (a digital certificate), in response. If one or more notaries report authentication information that is different than that received by the browser or other notaries, a computer user would have reason to suspect that an attacker has compromised the connection."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Worth it. (Score:5, Funny)
Re:Worth it. (Score:5, Insightful)
Well, I can live with it, but they could at least patch this feature to make it less annoying with self-signed certificates. Show a warning, yes, but right now the error message is too creepy.
Parent
Re:Worth it. (Score:4, Insightful)
amen. The error message seems to be designed for people who know about these things, not mom and pop users.
They could improve the message significantly, explaining what the problem is and what to do about it. Then I think the issue wouldn't be so big anymore. People would still complain about the number of clicks to accept a self-signed cert, but at least it would appear as legitimate information instead of an 'error'.
Parent
Re:Worth it. (Score:5, Insightful)
amen. The error message seems to be designed for people who know about these things, not mom and pop users.
I don't follow this sentence. That seems to describe *precisely* the old way of doing things, an easily dismissable box that only experts took note of and understood. The new method is *supposed* to bother users and get them to pay attention to the actual risk, while offering them a way to still accept it.
Whether or not you think being bothersome to users is a legitimate technique can and should be open to debate, but I don't think it targets experts at all...
Parent
Re:Worth it. (Score:5, Insightful)
I agree totally, the problem isn't the scary browser notices. It's websites and their poor security practices perhaps now that those practices are having a noticeable impact on their business these websites will change said practices and it wont be a problem anymore.
Parent
Unavoidable with devices (Score:5, Informative)
Self-signed certs are not always "poor security practices". Consider, for example, devices like the ubiquitous Linksys broadband routers. They support ssl connections for administration, which is probably a good idea (tm).
But signed certs require a domain name, and cost real money (typically $100/year), which is probably a little much for a home user who just wants the extra security on their LAN. So self-signed certs are perfectly reasonable for uses like that.
Parent
Re:Unavoidable with devices (Score:5, Insightful)
StartSSL supposedly offers free-as-in-free-beer SSL certificate-signing services, but even that's not really the issue in my opinion.
Why are we being told that we must get permission from a "trusted" authority in order to "legitimately" use encryption?
I wouldn't have even blinked if a commercial, proprietary browser started doing this...but "open source" Mozilla? Campaigning against do-it-yourself encryption? Just to "scare consumers" away from things that might possibly maybe be bad? That just seems completely wrong. The use-case mentioned above of the wifi router which can't necessarily get a "trusted authority" to verify due to lack of a FQDN is a good example of why this shouldn't just be of interest to do-it-yourself hobbyist nerds.
I still fail to see how being driven away from anti-eavesdropping (but unauthenticated) communications to completely unencrypted AND unauthenticated communications makes people "safer" and am a bit baffled that Mozilla is now treating unauthenticated certificates exactly like fraudelently authenticated certificates.
The usual retort here assumes that the only alternative is that self-signed certificates be treated the same as authenticated certificates and therefore people will somehow think they're "safe" even though there's a chance the site at the other end might possibly be involved with a "Man-in-the-middle" attack. There's also a disturbing assumption that only corporate "e-commerce" and government sites have any interest in "legitimate" encryption (the "they'll just go out of business if they don't 'buy' a certificate" arguments...). Of course, we do have to worry about the teeming masses of evildoers who break into people's houses to replace their wifi routers in order to steal their slashdot.org login password...
Why they don't want to consider having a third "encrypted but not 'secure'" state for correct but unauthenticated (self-signed) certificates or certificates that have gone past the arbitrary expiration date encoded in it I also don't know. Does Mozilla corporation have some kind of "partnership" with some of the big "Trusted Authorities" or something?
Parent
Re:Worth it. (Score:5, Insightful)
A) Don't even know what it is and
B) Don't even bother reading it once they figure out which order of buttons to push.
Even though the concept SHOULD be easy enough for anyone who can figure out how to browse the internet, the issue isn't comprehension but presentation. It's immediately demoted to "annoying pop up" as opposed to "informative box I should read" in the style it's in now.
Parent
Re:Worth it. (Score:5, Insightful)
Do you feel the same way about UAC in Vista?
It serves the EXACT same purpose.
Parent
Re:Worth it. (Score:5, Insightful)
They could do with a red-yellow-green warning system.
Red- sites with self signed certs which have changed since the last time you have visited them(keeping a record of all certs accepted to this point would be a good idea to help with this)
Yellow- Self signed cert. Warning first time you go to the site with accept/reject.
Green- Signed and verified by trusted 3rd party.
Sites which have a signed and verified cert and which have marked themselves as "should always be HTTPS" but which you are visiting with HTTP -should be red as well.
This way if some phisher sent you a link to http:\\paypal.com and paypal had registered with the trusted 3rd party that their site should always be using HTTPS then you get a red warning. Yes I know this would mean traffic to the trusted 3rd party whenever you visit any http site.
Parent
Re:Worth it. (Score:5, Insightful)
Good idea. But the browser should automatically accept self signed certs. After all, it'll automatically accept insecure (http) connections.
No! You switch to https to get a secure connection to who you're intending to talk to. A self-signed certificate doesn't tell you anything about who you're talking to. If you don't want security, stay on http.
Parent
Re:Worth it. (Score:5, Insightful)
No, I use SSL to obscure my messages from people in between me and the server. If I want to verify the party to whom I'm speaking, I'll go over there myself with a 6-pack.
The funny thing about that 6-pack is that it costs more than the "real" SSL certificate, and I actually have to show ID sometimes to get it.
Parent
Re:Worth it. (Score:5, Insightful)
No, if the site uses SSL and the certificate is invalid, it may be a "Man in the middle attack".
You can't just treat this like a http connection and not warn the user.
There are many sites which should use real encrypted connections (ie with a signed certificate + SSL). I'm not fond of sending sensitive info in the clear (that's about the same thing with a self-signed certificate...)
StartCom/StartSSL certificate are free and works with Firefox (and other CA are mostly cheap) so price is no longer an excuse...
Parent
That's the point (Score:5, Insightful)
amen. The error message seems to be designed for people who know about these things, not mom and pop users.
Mom and pop users should never, ever go to a website with self-signed or expired certs. It's true that there a lot of legitimate sites that fit the category, it might even be true that most of the self-signed sites are legit. The problem is that mom and pop users are not savvy enough to distrust anything, unless there's a big fat warning there.
Firefox 3 allows you to permanently accept those certificates. If you're computer literate enough to know about these things, you whitelist those sites. If you're a mom and pop user, you call a tech savvy family member / friend / neighbor / neighbor's kid to vouch the site for you and whitelist it.
Parent
Re:Worth it. (Score:5, Insightful)
Parent
Re:Worth it. (Score:5, Insightful)
Parent
Re:Worth it. (Score:5, Insightful)
This whole debate is rather off the point. Making changes to a security protocol in response to the last Slashdot thread is not exactly the best idea. There are more issues than just whether people can save a buck and get encryption. As you point out the point of the certificate is authentication, not encryption.
Back in 1995 the Netscape folk decided to write the protocol in such a way that you had to have authentication of the server public key to do encryption. As it happens I argued against that choice at the time, and again when the self-signed certs issue came up again a few years ago I have consistently argued that the browser should allow ANY connection to be encrypted with ANY key, just don't bother to worry the user about it unless the cert is trustworthy according to the user spec.
There are in fact changes in the works here. I am part of a W3C working group where we have discussed this exact issue. I have consistently argued for eliminating all security pop-up warnings of all types - they are designed to dump responsibility for security onto the user rather than be actually useful. I have also argued to make use of self-signed certificates easier as we should be moving to a position where security is the default on the Web.
Yes I do work for a CA, no I am not speaking for them on this particular occasion, but we have consistently argued to make use of unpaid cryptography as easy as possible because anything that expands the use of cryptography is going to eventually expand the demand for authenticated keys. I really don't think that we will have large numbers of people stop paying the price of a Thawte or GeoTrust cert and switch to a self-signed. More businesses will go the other way.
Its the same argument on code signing: all code should be signed, even development compiles. But only final production code should be signed with a trustworthy key - or the key is not going to be trustworthy very long. And only some final code will be signed by CA accredited keys. But that is fine if the O/S allows you to make statements of the sort 'drivers have to be signed by a trusted root, programs signed off a Web o' Trust key can run but only with restricted privs'.
Parent
Re:Worth it. (Score:5, Informative)
If the site uses a self-signed cert and hasn't changed since your last visit, you get no warning in Firefox 3.
If you visit a site for the first time and you get a self-signed certificate, that could be the only warning that you're the victim of a man-in-the-middle attack or DNS poisoning attack. You need a warning in that case. Please read the article I link to; it explains this point clearly.
Parent
Re:Worth it. (Score:5, Insightful)
Authentication doesn't exist on the internet because getting a genuine CA-signed certificate from a CA with a root that is already in your browser is hardly any more difficult or expensive than making a self-signed certificate. The tragedy is that the lock icon makes people feel safe when in reality, the authentication of the transaction relies entirely on supposed background checks which may or may not have been done by some CA that you won't know about unless you examine the certificate.
Does anyone else see the problem with this!?
A better idea is for the browser to raise the big warning flags for changed certificates (CA-signed or otherwise) so users can check manually whether it is a man-in-the-middle attempt or an official updated certificate from the site, and treat all https transactions as encrypted and better than a transaction with no encryption (regular http).
A better long-term fix for this problem is to create a system (or use the system we have) to actually ensure authentication on the internet. For this to happen, we need browsers to stop including CA roots from CAs which happily sign certificates with zero or insufficient background checks. Of course this isn't bulletproof, but it would go a long way to providing real authentication on the internet.
In the meantime, people need to stop thinking CA-signed certificates are very much safer than self-signed certificates. A CA-signed certificate from a specific CA that is known to provide good background checks is useful for authentication, but a CA-signed certificate from some random hole-in-the-wall CA that has a root in your browser provides no more authentication than a self-signed certificate does. At least its a step in the right direction for FF3 to show some information about the certificate from the URL bar rather than making users examine the certificate so that we can make our own determination of whether we trust the site based on if we trust the CA or not. Anyway, it's really the changed certificate that you need to worry about, regardless of who signed it, and encryption is also better than no encryption since at least the sniffers won't also get your info.
Parent
Re:Worth it. (Score:5, Insightful)
Parent
Re:Worth it. (Score:5, Insightful)
Browsers that allow this kind of lax security atmosphere are part of the problem.
Parent
Re:Worth it. (Score:5, Insightful)
Better yet: expect the non-technical crowd, the users, to put up with errors of the pro-technical crowd, the site maintainers.
Excellent shift of responsibility towards, right?
I think this is an issue of whiny webmasters, really. A proper certificate is around 10 bucks per year and although they issue it to anyone, it is security at a much higher level than using a self-signed crutch.
If you're a website owner, put up those 10 dollars and stop complaining. Keep your house clean and your certificates valid.
EVERYTHING you do by that is better than to accustom millions of non-technical users to click away any and all error messages when surfing. If all browsers would show these drastic certificiate errors AND all SSL-loving webmasters would keep their certs updated, we would have less issues in phising and scamming, much less.
Either you have security or you don't. Encrypting to someone is useless or even dangerous when you mistake the identity of the receiver.
Parent
Re:Worth it. (Score:5, Insightful)
Currently the only difference between a self signed cert and a $10 one is that the latter leaves you $10 poorer. There is no practical difference between the two. As a matter of fact, the current methodology of including certain CAs in browsers provides a false sense of security - which decreases the value of the system as a whole.
Parent
That's the point. (Score:5, Insightful)
Isn't scaring away inexperienced users from sites with questionable security the whole point of those warnings?
I mean a user friendly message that lets someone get past it really easily wouldn't exactly get the job done.
Re:That's the point. (Score:5, Funny)
Didn't scare me away. I just bought a laptop from neweggs.com for a fantastic price, and their cert was expired. They even added a second layer of security for credit card transactions, requesting my SSN and driver's license. I can appreciate that level of trust from a website.
Parent
Re:That's the point. (Score:5, Insightful)
Isn't scaring away inexperienced users from sites with questionable security the whole point of those warnings?
I mean a user friendly message that lets someone get past it really easily wouldn't exactly get the job done.
Plain http is even more questionable, and somehow it doesn't complain about that. Also, some people tend to think that CAs are more security theater than real security, and there are better ways to do things.
Parent
Re:That's the point. (Score:5, Insightful)
Encouraging web browsers to ignore security irregularities and allow users to access sites that handle private information *without* bringing it to the user's attention is just irresponsible.
Parent
Re:That's the point. (Score:4, Interesting)
Because not all of these sites are questionable...
All it does is force these sites to buy certificates from the existing ssl certificate cartel.
Your site isn't questionable, but the business or sysadmin behind it IS. I'm sorry, but when you find you want/need to run SSL encryption, an SSL cert is around $150/year. Not exactly extortion when you consider all the other expenses to run a website (hardware, OS licenses, bandwith).
Parent
Re:That's the point. (Score:5, Informative)
Parent
Re:That's the point. (Score:4, Insightful)
b) Most experienced users are very happy with self-signed certificates - they are mainly trying to avoid middleman secutiry issues (ISP, employer and other big brother types).
Uh, self-signed certificates are WIDE OPEN to MITM attacks. That's kind of the point here? Maybe you're not as experienced as you think?
Parent
Re:That's the point. (Score:5, Informative)
No, they are not. I'm afraid you are not as experienced as you think.
You see, self-signed certificates are only wide open to MITM attacks if the person monitoring you was replacing all certificates pro-actively before you even visited the website once. If you however have visited the site before, Firefox will warn you that the certicate has changed when a MITM changes it. At this point Firefox should display a big red warning.
Furthermore, and this is the part that people like you donot seem to grasp, there IS use for encryption beyond protection from MITM attacks. Using SSL encryption protects me from password sniffers that sit on my network, or in my wireless neighbourhood or from some comprimised router my request travels over. It protects me from some script kiddy running a network monitor seeing what I'm typing in HTTP forms. Yes, it does not protect me from a REAL MITM attack (unless of course I've been there before, and see that the certicate changed), however the sites providing simple SSL encryption just for the sake of not sending stuff in plain text are not worth attacking anyway.
Parent
Re:That's the point. (Score:5, Insightful)
Parent
Security Is worth It With all the Troll Sites (Score:5, Interesting)
Re:Security Is worth It With all the Troll Sites (Score:5, Insightful)
A false sense of security is worse than a known insecurity.
Parent
There's another hassle too (Score:5, Informative)
Try going to multiple Linksys devices (WRT54Gs come to mind) with the same self-signed certificate.
This is what you'll see:
You have received an invalid certificate. Please contact the server administrator or email correspondent and give them the following information:
Your certificate contains the same serial number as another certificate issued by the certificate authority. Please get a new certificate containing a unique serial number.
(Error code: sec_error_reused_issuer_and_serial)
You'll only be able to set up an exception for the first one, the rest of them... so sorry so sad... unless you manually dump the certificate each time.
FF2 did not have this "feature", you could set multiple exceptions and not have to worry about it again.
Total PITA if you're working with residential users.
Re:There's another hassle too (Score:5, Insightful)
Parent
This is the RIGHT solution... (Score:5, Insightful)
If you EVER want to combat man in the middle attacks and phishing sites, this is the best solution. Sites whining that people are being scared away??!? Get a fucking grip, and get a real certificate from a real certificate authority so your users can actually trust you. People/companies are cheap and lazy, and unfortunately this leads to a whole host of problems...keeping your certificate legitimate and up to date should be no different than taking care of your insurance or other critical infrastructure.
Re:This is the RIGHT solution... (Score:4, Insightful)
exactly. Every time people jump through the hoops required to accept a lapsed certificate all the valid certificates in the world lose a little bit of value because the user just got conditioned a little bit more to see certificates as nothing but a hassle.
Parent
Another Solution to Self Signing? (Score:4, Interesting)
Obviously, self signing is meaningless for anonymous strangers. It works just fine for you and your friends/colleagues, but not for anyone outside your immediately trusted group.
What are the free alternatives to VeriSign's hefty [verisign.com] fees? Some kind of community effort to create trust, much like PGP key signing seems like it would be a good solution.
Besides being expensive, it looks like any shmo can register with verisign and then conduct all sorts of questionable practices behind their cert. It doesn't look like there's any sort of vetting in the process. I didn't complete the signup process, but it looked like once they had my money, they'd send me a certificate. While the connection is secure, that doesn't tell me a darn thing about what they are going to do with my data, or weather or not they're going to try something malicious.
Re:Another Solution to Self Signing? (Score:5, Informative)
The point of a certificate is not to guarantee that the owner won't do something malicious. The point is to guarantee that the only person who can decrypt the communications is the site you think you're talking to. It's a guarantee that someone else will not listen in on the conversation.
For a free certificate that works in Firefox, you can use StartSSL. For a cheap certificate that works in all browsers, you can use RapidSSL.
Parent
No Excuses (Score:5, Insightful)
I do have more sympathy with self-signed certificates.There is no excuse for corporates to be using them, but for small, non-profit sites, self-signed is understandable. Mozilla could help this situation by providing support for CACert [cacert.org] and similar organisations, by including their signing certs in their browsers, by default.
GOOD! (Score:4, Insightful)
Conditioning the users to accept self-signed certs is a BAD thing.
I think self-signing is great for HTTP and with SSH-style leap of faith. But self signed is far less useful than a real cert (because even when social engineered, a real cert allows you to say "registrar X f-ed up".) for HTTPS. And conditioning users to accept self-signed certs for HTTPS is a mistake.
expected behaviour (Score:5, Insightful)
This way of handling websites with expired or self-signed SSL certificates is bound to scare away a lot of inexperienced users, no matter how legitimate the website is.
Well that's the point. The certificate is not valid and there is no way to tell the website is legitimate. If one would insist on using TLS/SSL for HTTP with a self-signed certificate, have users install your own CA keys you gave them through another secure channel, or at least let them check the fingerprint. Nobody keeps you from doing that. It's sad that some of these things are so widely misunderstood that it actually reduces privacy and security:
The new behavior of Firefox 3 is not a problem, it's people failing to security-enable their website the right way.
I'm Firefox, I'm IE (Score:5, Insightful)
This is a switch of the "Cancel/Allow [youtube.com]" Mac/PC ad.
Here we have FF3 saying
"You have tried to access a secure site with a dodgy certificate, Cancel or Allow?"
IE meanwhile troops on regardless giving a better "user experience"
Oh until the machine goes down because the site was a trojan site using a self-signed certificate.
The issue here isn't that Firefox is making this hard, its that ANYONE ever made this easy. If a site has an expired certificate then that would worry me as it implies their IT support is a bit dodgy. If someone wants my credit card details and is using a self-signed certificate then I'm VERY worried.
There are functional issues (the duplicate cert problems of Linksys has been mentioned here) that should be addressed. But the basic problem of warning users very strongly that a site is self-signed or has an expired certificate is a good thing.
I'm using Firefox, I'm on a Mac and this problem just hasn't irritated me the way that Vista does because this does it when there is a REAL problem caused by a 3rd party, not a potential problem caused by me hitting a button. Expired or self-signed certs are a real 3rd party problem, not a scare story.
As a Safari user (Score:5, Insightful)
As a Safari user, i find that reading mainstream media and "security researchers" fucking hurts my head.
First Safari is bad because it doesn't have anti-phishing.
Then FireFox is bad because because it throws a fit on un-signed certificates.
WTF do they all recommend? Exploder?
I guess it all fits with the flow of uneducated American populace, too ignorant to learn to use a computer properly, so "Security Experts" need to be babysitting them.
(for those of you wondering why I use Safari, it's because of its superb in page find feature.)
As long as we're complaining about browsers (Score:4, Informative)
Let's complain about how easy it is for you to navigate to a malicious page in IE and get malware on your PC.
Seriously people, this isn't a huge deal. Err on the side of security rather than the other side, I would say.
I think Firefox's solution is the best we can hope for. If you or me can get a self-signed cert, a phishing site author certainly can. Then all of a sudden if Firefox were to accept self-signed certs, phishing sites over HTTPS look legitimate, and they look the same as every other HTTPS site that shelled out $$$ to get their certs signed by a trusted root authority. Hell it doesn't even cost $$$, there are a few root authorities that'll sign certs for free, and one is accepted by Firefox (I forget the name). So that's always an option. If you don't like adding exceptions to your own pages, get on Google and figure out how to fix it!
Certificate hijacking (Score:5, Informative)
SSL Certificate hijacking is a real issue so it should not be underestimated. Users should not be able to just dismiss a warning dialog like they can do with IE. However I do think self signed certs shouldn't be discriminated this way. Learn more with presentation #11 here:
http://www.securitypresentations.com/#11 [securitypr...ations.com]
Before everyone posts the 'so obvious' facts... (Score:5, Insightful)
Before all the security fanatics start telling everyone to "just spend ten bucks on a cert"...
1. Embedded appliances (you know, the hundreds of millions of routers, firewalls, etc.) cannot use an authority cert. The choice is between self-signed and no encryption only, and Firefox is pushing manufacturers towards the less secure option.
2. Typically, you first encounter a self-signed cert in a secure context (for example, setting up such an appliance by plugging it directly into your PC and visiting the web interface). After that, all you care about is whether the cert changes. The whole man-in-the-middle thing is NOT a guaranteed problem with self-signed certs.
3. Real cert authorities are not the invulnerable swiss banks everyone thinks they are. They can and have issued certs when they shouldn't have. And that isn't just new certs; last week there was a story about a Firefox-trusted cert authority that issued a Microsoft live.com domain cert to someone. So those who think authority certs are secure are deluding themselves.
In the end, Firefox's current behavior does not promote security; it simply makes life hard and annoying for legitimate users.
Why we have certificate authorities (Score:5, Informative)
I'm going to assume that there is a sizable minority here who doesn't actually understand what is going on with SSL certificates and why they are important. So here goes:
Assume you're trying to access your online bank, and that Dr Evil is your ISP's systems admin (or anyone else who can get between you and your bank).
In the normal course of things, your web browser makes an SSL connection to your bank, validates the certificate is signed by one of the certificate authorities that your browser trusts and you're good to go.
The certificate authority check is there to prevent Dr. Evil from setting up a server in between you and your bank. In that scenario, you would connect to Dr Evil, get his key, encrypt your username and password using his key. Dr Evil then decodes the user/password and sends it onto the bank in another connection. Then he bridges the two connections, walks off with your password and you're none the wiser.
Because of SSL certificates, if Dr Evil did try it, you'd get the nasty certificate warning, and hopefully not give Dr Evil your banking passwords.
Min
What has this got to do with Firefox? (Score:5, Insightful)
I know using actual evidence is unfashionable, but lets try connecting to a self-signed https page from some popular browsers, shall we?
Firefox 3
Secure Connection Failed
phishing.itsdapead.org uses an invalid security certificate.
The certificate is not trusted because the issuer certificate is unknown.
The certificate is only valid for mycomputer.itsdapead.com
[Or you can add an exception]
Internet explorer 7:
There is a problem with this website's security certificate.
The security certificate presented by this website was not issued by a trusted certificate authority.
The security certificate presented by this website was issued for a different website's address.
Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.
We recommend that you close this webpage and do not continue to this website.
Click here to close this webpage.
Continue to this website (not recommended).
Or Safari 3:
The certificate for this website was signed by an unknown certifying authority. You might be connecting to a website that is pretending to be "phishing.itsdapead.org" which could put your confidential information at risk. Would you like to connect to the website anyway?
How about Opera 9.5?
The server's certificate chain is incomplete, and the signer(s) are not registered. Accept?
[Help] [Reject] [Approve]
Sorry, I don't believe that - Opera is meant to be good isn't it? Let's try again: (ahem) Opera 9.5?
The server's certificate chain is incomplete, and the signer(s) are not registered. Accept?
[Help] [Reject] [Approve]
Ye gods - I wasn't imagining it! Deary, deary me...
Now, from where I'm standing:
Plus, Firefox is pushing the extended info scheme whereby the certificate holder's name gets displayed on the info bar (as opposed to the old scheme where ploughing through the certificate might reveal the holder's name), which should be a good thing.