Forgot your password?
typodupeerror
Mozilla The Internet Security

Mozilla SSL Policy Considered Bad For the Web 897

Posted by kdawson
from the among-these-shall-be-life-liberty-and-acces-to-https dept.
Chandon Seldon writes "The issue of digital certificates for SSL and the policies surrounding them comes up repeatedly. I've written an article criticizing the behavior in Firefox 3, which includes a serious comparison of the current Mozilla policy — restricting encrypted HTTP to paying customers — to a violation of net neutrality."
This discussion has been archived. No new comments can be posted.

Mozilla SSL Policy Considered Bad For the Web

Comments Filter:
  • One Question (Score:5, Insightful)

    by frodo from middle ea (602941) on Monday August 04, 2008 @08:12AM (#24464701) Homepage
    wouldn't implementing what the author suggest, defeat the very purpose of having a CA ? SSL is not just for encryption you know. There is a little thing called 'trust' which pays a big part in it too.
    • Re:One Question (Score:5, Insightful)

      by Iamthecheese (1264298) on Monday August 04, 2008 @08:17AM (#24464765)
      It didn't make sense, the thing you just said. The author is proposing an easier flow to accepting self-signed certificates. How could that defeat the purpose of having a CA?

      While he may have a valid point, I resent and disagree strongly with the author's implication that there is a profit motive to this. A bad decision, but not one made for profit.
      • Re:One Question (Score:5, Insightful)

        by cryptoguy (876410) on Monday August 04, 2008 @09:54AM (#24465977)
        There are lots of times when SSL is used for less than its complete feature set. SSL provides a mechanism for *mutual* authentication, but how often does the server actually require a verified SSL certificate from the client? The fact that servers usually don't do this does not mean SSL is not useful in that context. Likewise, the absence of a verified server side certificate does not necessarily mean that SSL is providing no value. Encryption without authentication provides a degree of privacy, raising the level of difficulty significantly for anyone who would want to eavesdrop. When a client encounters a self-signed certificate, or when the certificate is a type that is weakly verified by the CA, the client should simply notify the user of that fact. That can be done with a single notifier. The notifier can provide the user the option of verifiying the certificate out-of-band so it will be trusted next time without a nag screen.
    • Re:One Question (Score:5, Insightful)

      by adamwright (536224) on Monday August 04, 2008 @08:18AM (#24464775) Homepage

      If there was any real "trust" component, I'd buy this argument. SSL certificate authorities are supposed to be sources of trust - we trust them to have authenticated that the FooCorp who bought a certificate really is FooCorp Ltd (and not F0oCorpe). However, the only inducement most vendors need to issue a certificate these days is money.

      I've successfully bought SSL certificates for companies that I had little or no verifiable connection with, from authorities that are trusted by all major browsers. Now, I obtained these with full permission of the companies in question, as a contractor, but as far as the authority was concerned, I was Joe Bloggs. They've even realised that now, and introduced the new EV Certificates - now with Extra Validation! Until of course, these get paid off as well, and we need EEV Certificates and so forth.

      Using SSL for trust based on the word of companies like Verisign is pointless - you have to do manual authentication. The only use I see for them these days is transport encryption.

      • Re: (Score:3, Interesting)

        I've successfully bought SSL certificates for companies that I had little or no verifiable connection with, from authorities that are trusted by all major browsers. Now, I obtained these with full permission of the companies in question, as a contractor, but as far as the authority was concerned, I was Joe Bloggs.

        Same exact experience here. And the thing is that they don't even bother calling anyone to verify anything. I've even used my own credit card to buy certificates.

      • Re: (Score:3, Insightful)

        by lucifuge31337 (529072)

        This is exactly the point I was going to bring up. If you have access to install a certificate on a web server, you most likely have access to an admin-like email address, which is really all that is needed to get a "trusted" cert. One of the companies I use will validate by email to a domain contact or alternately to root@, postmaster@, webmaster@, admin@, etc. (a list of about a dozen they will accept).

        SSL is useless for initial authentication, however, like most SSH implementations, if it were made eas

      • Re: (Score:3, Insightful)

        by shaitand (626655)

        Agreed. And there is an open CA that the major browsers don't include in their root list either.

        It verifies DNS control. That is more than some of the cert whores and really all I need a CA to verify since it prevents man in the middle attacks.

        Even a self-signed cert is dramatically better than an unencrypted connection. Security is not an all or none affair, encrypted is better than unencrypted, and encrypted and trusted is better than merely encrypted. The current prompts make it appear as if unencrypted

    • Re:One Question (Score:4, Insightful)

      by Anonymous Brave Guy (457657) on Monday August 04, 2008 @08:23AM (#24464825)

      Sure, but frankly, anyone who relies on the "trust" aspect of SSL certificates today for anything serious needs their head examined. In this world, trustworthy == willing and able to pay.

      The encryption is by far the most important aspect of SSL for most applications, and you can use that regardless of any issues with CAs and trust.

    • Re:One Question (Score:4, Insightful)

      by Ed Avis (5917) <ed@membled.com> on Monday August 04, 2008 @08:55AM (#24465157) Homepage

      The question you should ask is why is a website using a self-signed certificate presented to the user as *less safe* than one that is sending all information in the clear?

    • Re: (Score:3, Insightful)

      by shaitand (626655)

      From TFA:

      'This ignores the value of simple encryption. Snooping a connection (i.e. on a wireless link) is much easier than any of the impersonation attacks that SSL authentication prevents.'

      He is right. Since when is security an all or none affair? Security is about making it more difficult to attack with the understanding there are always attacks you can't protect against. An alert saying that 'a secure connection is established but the identity of this website has not been verified by a central authority'

  • This is stupid (Score:4, Insightful)

    by duffbeer703 (177751) on Monday August 04, 2008 @08:12AM (#24464713)

    The whole point of SSL is to have some assurance that you are connecting to whom you think you're are connecting to.

    While the model of paying a CA to assure your identity is not perfect by any means, ignoring the issue isn't either. Many slashdotters seem to have a hard time getting this.

    IMHO, the system in Firefox 3 is superior. While self-signed sites are blocked by default, it is not easier to explicitly trust a self-signed SSL site. In the past, most people would just click past the nag dialog when it popped up.

    • Re:This is stupid (Score:5, Informative)

      by jgtg32a (1173373) on Monday August 04, 2008 @08:22AM (#24464815)
      But there's one problem you understand what the error message says and means.
      My parents couldn't get past that message even after I explained it. I had to downgrade FF because they would freak out when they saw that message.
      From a usability point of view its terrible.
      • Re:This is stupid (Score:5, Insightful)

        by quantumplacet (1195335) on Monday August 04, 2008 @08:30AM (#24464895)

        I think that's exactly the point. If you can't understand what a self signed certificate is, you shouldn't be accepting them.

        • Re: (Score:3, Insightful)

          by mxs (42717)

          That's a pretty bad point. Are you suggesting that if you can't understand what a certificate is, you shouldn't be using SSL ? If you can't understand what HTTP is, you shouldn't browse the web ? If you can't understand what BGP is, you shouldn't be using HTTP ?

          If you can't understand what a self-signed certificate ist, you should only be accepting them once you either a.) learned how to understand it or b.) somebody you trust tells you to or c.) you do not implicitly care about the implications since you a

    • Re:This is stupid (Score:5, Insightful)

      by js_sebastian (946118) on Monday August 04, 2008 @08:30AM (#24464889)

      The whole point of SSL is to have some assurance that you are connecting to whom you think you're are connecting to.

      No. As TFA says, there are 2 points to SSL. 1 is to provide confidentiality (encryption) the other is to authenticate the server to the user. A server with a self-signed certificate provides protection against passing (but not active) snooping. This is worse than what a real, trusted-third-party signed certificate provides, but it is better than no encryption at all!

      So why does the firefox GUI make a site with a self-signed certificate appear (to the non-technical user) less secure than a plain HTTP site?

      IMHO TFA is very much correct this is a problem. The solution is not obvious, because users are used to the lock icon and may not understand the concept that confidentiality and authentication are 2 separate protperties, so how do we design a GUI which does not mislead him.

      • Re:This is stupid (Score:4, Insightful)

        by duffbeer703 (177751) on Monday August 04, 2008 @08:36AM (#24464955)

        IMHO TFA is very much correct this is a problem. The solution is not obvious, because users are used to the lock icon and may not understand the concept that confidentiality and authentication are 2 separate protperties, so how do we design a GUI which does not mislead him.

        The people who don't understand this are not IT people who are going to be futzing with self-signed certs, or are IT people who need to clue up and understand the implications of using self-signed certs.

      • Re:This is stupid (Score:5, Insightful)

        by pmontra (738736) on Monday August 04, 2008 @08:49AM (#24465071) Homepage

        Let's do it with alert boxes.

        HTTP only: "The communication with this site is insecure because it doesn't ecrypt the data you're sending to it. Furthermore there is no guarantee that it's owned by the organization that it claims to belong to. [checkbox] Don't tell this to me anymore.

        Self signed HTTPS: "The communication with this site is secure because it encrypts the data you're sending to it. However there is no guarantee that it's owned by the organization that it claims to belong to. [checkbox] Don't tell this to me anymore."

        CA's signed HTTPS: "The communication with this site is secure because it encrypts the data you're sending to it. Furthermore [the name of the CA] guarantees that the site is really owned by the organization that it claims to belong to. [checkbox] Don't tell this to me anymore."

        However one has to be really naive to believe the guarantee part of the last statement or that CAs are willing to have any legal responsibility for the claims they're issuing with any certificate. Actually that third alert box might be harmful as it perpetuates the delusion that certificates do anything about authentication.

        Eventually it's not a problem of GUIs but a problem of understanding what certificates are really for.

    • Re: (Score:3, Insightful)

      While I like Firefox 3, I find it annoying that I have to accept a self-signed certificate forever. I'd much prefer to accept it from my current session only. Accepting it forever seems a little insecure to me.

      Regards
      elFarto

      • Re:This is stupid (Score:4, Insightful)

        by PIBM (588930) on Monday August 04, 2008 @09:24AM (#24465527) Homepage

        Except that it's actually the secure thing to do.

        If you check the probability that the site you are using will get hacked in the lifetime usage of it that you will do, in most case the first usage of the website will be on the valid one, and you will then learn about a Man-in-the-middle attack when it will say that there's a new certificate to accept (every other time it had not asked you).

        If you don't accept the certificate, you'll be clicking all the steps everytime for that website anyway, so you won't notice the different MD5/SHA1 hash, and in fact won't even look at it.

        If it happened to you that you first used it on a day with an attack, then the next day or so, when it's fixed, you'll have a new certificate, and know that there's been something wrong (site will most probably talk about it) and you will be able to react fast, since you know you were subject to the man in the middle attack.

        Anyway ..

  • by gnasher719 (869701) on Monday August 04, 2008 @08:13AM (#24464715)
    I think it is. Half of SSL is about encrypting a connection, the other half is about knowing whether you can trust the other side. What the article suggests (that SSL connections when the other side uses a self-signed certificate should give no warning) would completely destroy security of the Internet.
    • by Hes Nikke (237581) <slashdot@gotna t e .com> on Monday August 04, 2008 @08:18AM (#24464769) Journal

      There is a "warning," and then there is a "WARNING: YOU MUST CLICK FIVE TIMES TO SEE THIS PAGE." A simple bar across the top of the page with a warning that the sites identity couldn't be verified, but that the connection was still encrypted would work just fine.

    • Re: (Score:3, Insightful)

      by Kjella (173770)

      I think it is. Half of SSL is about encrypting a connection, the other half is about knowing whether you can trust the other side. What the article suggests (that SSL connections when the other side uses a self-signed certificate should give no warning) would completely destroy security of the Internet.

      If self-signed SSL sites were indentified similar to "trusted" sites, then yes. But self-signed SSL certificates are a good step up in security over HTTP. For example, anyone only able to wiretap won't get anything at all. Intercepting streams for a MITM is a much more difficult thing to do, particularly if you're talking large volumes in real time. Also you'd get uh-ohs like "This site is now using a different key than last time" and some would compare fingerprints through some other secure channel so mass

  • by Daryen (1138567) on Monday August 04, 2008 @08:13AM (#24464721)

    I encourage all of my users to use Firefox by including it on our PC images, showing them it's cool features, and letting them know about how it's more secure. I've been running into problems with self-signed SSL certificates though.

    I run a router/firewall based on the Untangle software, which in turn is a modified Debian/Knoppix setup. It also does VPN, based on the open source openVPN software, and it uses self-signed SSL certificates for it. While I don't mind adding our firewalls to a safe list, my users freak out with all of the warnings and aren't sure what they should do. I've been telling them to use Internet Explorer, but it makes my skin crawl to say it. Hopefully the Mozilla team will reconsider their position to make their software more open-source friendly.

  • by RomSteady (533144) on Monday August 04, 2008 @08:15AM (#24464737) Homepage Journal

    The average user doesn't notice any security feature unless it is in their face.

    Given the number of phishing sites out there, it could be argued that every additional slap to the face that a user would have to get through in order to get to a phishing site (known phishing site, self-signed SSL, acknowledge that you are a fucking retard for bypassing the last two warnings, etc.) may be worth it.

    Just remember that just because the precepts of net neutrality (all bandwidth is equal) means that we should let a user shoot themselves in the head doesn't mean that we shouldn't at least make a passing effort to put a safety on the gun they are using.

    • Re: (Score:3, Insightful)

      Given the number of phishing sites out there, it could be argued that every additional slap to the face that a user would have to get through in order to get to a phishing site (known phishing site, self-signed SSL, acknowledge that you are a fucking retard for bypassing the last two warnings, etc.) may be worth it.

      That makes perfect sense, except, when it comes to things we don't like here on slashdot, we don't allow half measures. If it doesn't 100% eliminate phishing, then all it does is piss off legitim

  • four clicks (Score:5, Informative)

    by Bazman (4849) on Monday August 04, 2008 @08:16AM (#24464751) Journal

    In four mouse clicks I've added that site to my exceptions list. It warned me, I read and understood the warning, I acted. I saw the https page and the web site owner didn't have to pay for a certificate.

    So, the article is wrong:
    "Mozilla Firefox 3 limits usable encrypted (SSL) web sites to those who are willing to pay money to one of their approved digital certificate vendors"

    please add 'or click four times to add the site to an exception list'.

    • Re: (Score:3, Funny)

      In four mouse clicks I've added that site to my exceptions list. It warned me, I read and understood the warning, I acted.

      Good for you, but people like you - and me and the rest of the people here - aren't "normal". Grandma won't know what the hell to do (besides call you). She might even think "those evil hackers" "got her".

      Self-signed certs are a potential problem, but Firefox could have worked out a better way of handling it. A more novice-friendly way.

      Basically, we need Bruce Schneier [schneier.com] and Jakob Nielsen [useit.com] to marry and have children. We'd better contact Dr. Moreau [wikipedia.org] to work out the breeding program. :)

      • Re: (Score:3, Insightful)

        by Nursie (632944)

        "Grandma won't know what the hell to do"

        And Grandma doesn't care about getting secure access to your blog.

        She cares about reading the news, chatting about knitting on the wool forum, sending email to the grandkids and accessing her bank account. Only the last one requires encryption, and for that you want full third-party authentication.

        Streamlining this process or just warning Grandma will leave her with an empty bank account in no time.

  • by PC and Sony Fanboy (1248258) on Monday August 04, 2008 @08:18AM (#24464767) Journal
    I'm not sure what the problem here is - If a website claims that it isn't part of the malware revolution with a self signed certificate, it isn't any more authentic than NOT having one.

    The only real use for a self signed certificate is for large institutions that already have the trust of the user (ie: universities) - but you have to assume that they havn't been compromised, because it would be easy to have a second certificate, signed by the owner of the hijacked site.

    Anyways, firefox 3 does a great job, and it isn't hard to add an exception - and it isn't annoying like UAE...
  • by unity100 (970058) on Monday August 04, 2008 @08:22AM (#24464809) Homepage Journal
    "we are programmers and developers, and as a community we think this is the right thing to do" - this does NOT fly. public accepts what they like, they refuse what they dont. this is as simple as that, REGARDLESS OF what they accept or refuse may be good, or bad.

    it is utterly stupid to go overly jacobin and enforce something on people 'for improving the security on the web', in an open source project that is made by people FOR the people.

    a lot of websites, service owners, businesses using vpn and their clients and their users are going to experience hell lot of problems due to this extreme self righteousness forced upon them, if they go for firefox 3.

    to be honest, despite im fighting for free and open internet, linux, open source by the means available to me as much as i can, i will be advising friends and clients to stay away from ff3 because of that certificate issue.
  • Bad Article (Score:5, Informative)

    by MasterOfMagic (151058) on Monday August 04, 2008 @08:23AM (#24464823) Journal

    As mentioned on the Firehose comments page about this article (http://tech.slashdot.org/comments.pl?sid=634651&cid=24461415):

    CAcert is working to be included by default in all Mozilla Foundation software [mozilla.org]. CAcert [cacert.org] is based on having certificates for everybody, not just for paying customers. They are already included in many current distro version of Firefox [cacert.org]. There's no objection in the Mozilla Foundation to including certificate authorities like CAcert in Mozilla. Mozilla just needs to verify that they are secure [mozilla.org] - a process that takes a long time and doesn't cost any money - otherwise they could undermine the security of their users. Five minutes of research would have shown this.

    For this problem to be solved, the most popular F/OSS browser(s) must accept self-signed certificates. If Mozilla is unwilling to change their policies, it would be worth the effort of trying to create a *more popular* fork with full SSL functionality.

    This shows a lacking understanding of computer security practice. Self-signed certificates are something that 90% of users need to be wary of because if you allow them by default, phishing sites will use them to their advantage and steal data, and Mozilla will be blamed for it because they'd be the only one to not warn about self-signed certificates. This is why people are warned and this is why there's already and override procedure in place so if you're one of the 10% of the users impacted by it, you can work around it.

    This article seems like an attempt to insert drama where recognized security professionals already have agreed that this is best practice. Wait until CAcert is in Mozilla, and if it gets special treatment by not being treated the same as all of the other CAs, then you'll have something.

    If the purpose of the Firehose is to vet articles, it's not doing a good job.

    • Re:Bad Article (Score:4, Interesting)

      by Cutie Pi (588366) on Monday August 04, 2008 @08:50AM (#24465093)

      If the purpose of the Firehose is to vet articles, it's not doing a good job.

      I don't think the purpose of Firehose is to vet articles. Rather, it's a way for Slashdot to become more Digg-like, and Digg-like content is what we get. Seriously, go back five, even two years ago and try to find front page stories in which some random person writes "I've written a controversial article on X. Click here to see my thoughts". You won't find many, but now you can find them almost daily on Slashdot. And along with the Digg-like content comes the Digg-like users, with all their conspiracy theories, hyperbole, immaturity, and general teenage boy mentalities that has driven away all but said demographic from Digg.

      Fortunately, Firehose is only a gateway to the editors, and not a direct route to the front page. Thus, the decline of Slashdot has been more gradual than the decline of Digg. But you'd be hard pressed to find a true geek that isn't longing for the good old days.

      And oh yeah, Get Off My Lawn!!

  • Mozilla is correct (Score:5, Insightful)

    by Antibozo (410516) on Monday August 04, 2008 @08:27AM (#24464851) Homepage

    I think the author makes Mozilla's case for them, by not appearing to understand the risks, especially at a time when DNS cache poisoning has become unusually feasible. E.g., the statement

    Snooping a connection (i.e. on a wireless link) is much easier than any of the impersonation attacks that SSL authentication prevents.

    is simply not true for clients of unpatched DNS servers. It's much easier for an attacker to get a remote user's traffic redirected to a host of his choosing than it is for him to snoop on that user's traffic. Volume-based attacks on DNS become increasingly easier as bandwidth increases, and people who operate botnets have a good chance of poisoning a cache even on patched nameservers, simply through brute force. Meanwhile, that smaller class of attackers who are in a position to actually snoop on traffic are also in a position to use an arp spoofing attack. Encryption is simply not useful without knowing whom you're encrypting to.

    If you're feeling lucky, you can always add the exception. You can also sign your certs with a CA cert, and import that into your certificate database. Of course, anyone who trusts that CA cert also trusts you not to generate bogus certs for bankofamerica.com, etc... The solution to the problem is not to make the browser more trusting by default; it's to migrate away from X.509 to a PKI that allows domain owners to generate certs at no additional cost, such as a DNSSEC-based PKI.

    I think Mozilla has it 100% right.

  • by mxs (42717) on Monday August 04, 2008 @08:29AM (#24464877)

    I originally meant to post this as a comment to the blog post, but apparently the author does not care about testing their commenting feature. This alone should already tell you stories about how much thought he puts into this stuff.

    -+-
    Why in the world are you singling out Mozilla in this ? Every browser has this policy.

    Every browser has avenues to add new root certs, too (I can just create my own CA, offer the certificate file on the web, and let users install that; all future communication with a site that has a certificate signed by that CA will not be bothered with these error messages). This may not be 100% convenient, you are correct. But it's not as if it was hard to do if you want to give your users the option of using encrypted sessions.

    Oh, and there IS a way to get your shiny new non-profit CA into the main Firefox builds. All you need to do is comply with their procedures and requirements -- which include policies on how you verify the identity of the certificates you sign, how revocations work, etc., and requiring specific minimum requirements in these. If you think you can run a proper CA for free for everybody with proper identity checking and day-to-day operations, do it and get it added !

    The default position Mozilla takes is quite simply that the CA should verify the identity of the entity the certificate is being issued to. You may not think that it is important for this to be such a prominent user interface feature, but many people do. Every user can add an exception for your site, you can add a CA of your own, you can get certified by a nonprofit CA (good luck finding one; I agree that most of them are scumbag operations that try to extract as much money from you as possible, but I have yet to see a proposal which both ensures identity checking and revocation management while being completely free ... Maybe you'll find a way).

    This has nothing to do with network neutrality. Nothing at all. A more proper comparison would be comparing this situation with that of 2nd-level domain names. You can't get a .com domain for free, either. Nor a .net or .org or most of the country TLDs. You can open up your own Registrar (but will still have to pay dues for domains registered), just as you can open up your own CA. It'll be a rocky road, and it'll not be free -- least of all in work required.

    My sites work just fine with SSL certs signed by my very own CA. Firefox displays them just fine (either by adding the root cert of my CA to it, or by simply adding an exception). All other browsers work fine, too. If you have visitors or customers that require validation of your certificate by a third party, you are SOL. But then again, you also would be were the warning worded differently (and there SHOULD be a warning for a certificate that is not signed by a trusted CA or one which you explicitly told the browser to trust. No matter what. Self-signed certs are alright for encryption, sure, but I want my browser to have a default setting of warning me when something is happening that very well could be an attack; especially when I have taken care to add a specific trusted CA (say, the one by my university).
    -+-

  • by rpp3po (641313) on Monday August 04, 2008 @08:33AM (#24464935)
    When do people finally realize that self signed certificates don't work? If I share your WLAN access in a public cafe it's really no big deal to play man in the middle and exchange the presented certificate for my own. Ok, it's more work than without, but not much (about 5 minutes). The only case where self-signed certificates can be secure is when you manually verify the validity of a certificate beforehand and save it in your cert store. If your first check of a certificate's validity happens to be while I'm attacking you (maybe because you are visiting the site for the first time) you will "verify" my hacked one. And don't tell me about hashes on webpages. Maybe 1 in 1000000 users checks this once in a while for pure curiosity, but not more.
  • by bconway (63464) on Monday August 04, 2008 @08:46AM (#24465055) Homepage

    A.) You don't need to buy certs from Mozilla, you can buy them from any number of CA's, for as little as $10. There are some free CA's, as well.
    B.) This isn't in any way related to network neutrality.

  • T-Shirt (Score:4, Insightful)

    by oglueck (235089) on Monday August 04, 2008 @09:11AM (#24465349) Homepage

    You buy a purple T-Shirt and 6 months later purple is out of fashion. Clearly the manufacturer's fault, right?

    Yes, SSL Certificates from a CA *are* expensive. Yes, you can encrypt with a self-signed cert. But that encryption is worth nothing at all. Because anyone (latest DNS vulnerabilities for instance) can easily forge these certificates, you don't know who you are communicating with in the first place. Of what use is point-to-point encryption if the man in the middle is undetectable?

    Yes, it 4 clicks to define an exception rule are a pain in the ass. But because it's that painful it will cause people (like the author) to think twice before they use a self-signed cert next time. So making the web safer in the end. Don't make it too painful (will hurt adoption of product), but painful enough so that decision makers get worried. I think FF3 behaves perfectly in that respect.

  • by the_other_chewey (1119125) on Monday August 04, 2008 @09:20AM (#24465465)
    From http://www.cs.auckland.ac.nz/~pgut001/pubs/phishing.pdf [auckland.ac.nz] :

    SSL certificates provide honesty-box security
    • Use a $495 Verisign certificate
      - People will come to your site
    • Use a $9.95 budget CA certificate
      - People will come to your site
    • Use a $0 self-signed certificate
      - People will come to your site
    • Use an expired or invalid certificate
      - People will come to your site
    • Use no certificate at all, just a disclaimer saying that you're secure
      - People will come to your site

    The whole PDF is a highly recommended read full of sad truths.
    Unfortunately, it is VERY hard to recondition users. I don't blame Mozilla for
    trying (in fact I completely agree with the change), but it will probably fail.

  • by duplicate-nickname (87112) on Monday August 04, 2008 @09:38AM (#24465733) Homepage

    In a world where phishing is a considerably bigger problem then someone snooping your connection, I have to agree with how Firefox functions here. Self-signed certificates provide no way to authenticate the website which is even more important these days after the recent DNS exploits.

    I think Mozilla's large "Failed!" message is much better than a default-accept of self-signed certs with a small warning message that would be ignored by 90% of users. Besides, Firefox will still allow self-signed certs after manual intervention.

  • by mlwmohawk (801821) on Monday August 04, 2008 @09:45AM (#24465847)

    In the vocabulary of international politics, we need to "trust but verify." Which means no trust at all.

    There needs to be a mechanism where a vendor or site can send you a certificate in a way that can't be spoofed. And can then be verified. Maybe it is an email, maybe it is snail mail?

    What I don't like about SSL in web browsers, is that they have ignored the "verify" aspect of trust by abdicating the responsibility to a "pay for trust" regime which is bogus. If they can pay, they are trust worthy, right?

    Ideally, I should be able to receive a password in the mail (or some form of communication) to unlock a "key" file sent to me from someone I want to trust. I then unlock and install that key on my system and only keys *I* trust get trusted.

    It should be easy and standardized across most platforms. Anything less is broken.

egrep -n '^[a-z].*\(' $ | sort -t':' +2.0

Working...