Re: Root certificate authorities

2011-03-14 Thread Steve Schultze
On 3/5/11 3:22 PM, Nelson B Bolyard wrote: Brian Smith wrote: Ritmo2k wrote: Anyone know if its possible to configure Firefox to implicitly trust all certificate authorities installed in the Windows Trusted Root Certification Authorities Store? Firefox does not support this yet. See:

Re: TLS server keys in DNS: client policy proposal

2011-02-12 Thread Steve Schultze
Zack, I think having some kind of statement from the Moz community could be helpful, and a good excuse for Moz folks to get up to speed on the spec. With respect to the Section 3 text, it may be best simply to voice your thoughts directly on the DANE list. I don't think the current text is

Re: TLS server keys in DNS: client policy proposal

2011-02-11 Thread Steve Schultze
On 2/11/11 6:04 PM, Eddy Nigg wrote: Indeed, PAYPA1.COM, MICR0S0FT.COM, PAYPAL.DOM.COM, BANK0FAMERICA.COMall goes. Of course not, that's why we have this: http://www.antiphishing.org/reports/APWG_GlobalPhishingSurvey_2H2009.pdf Have you actually read that report? It details a rapid

Re: TLS server keys in DNS: client policy proposal

2011-02-10 Thread Steve Schultze
On 2/6/11 1:01 PM, Eddy Nigg wrote: On 02/06/2011 07:11 PM, From Zack Weinberg: I'm going to ask you the same question I asked Nelson: In a hypothetical world where DNSSEC+TLSA completely supersedes DV (but people still use OV/EV for high-value sites) what do you see as having been lost? Or,

Re: TLS server keys in DNS: client policy proposal

2011-02-10 Thread Steve Schultze
On 2/7/11 6:31 PM, Robert Relyea wrote: My primary worry of the this spec as is is that DNSSEC is trying to be the end-all-be-all authority. That's a recipe for disaster. Keeping all my server keys in sync with the DNSSEC record? And if I have OV/EV, I have to keep it in sync with the