On 6/4/09 12:27, Gervase Markham wrote:
On 04/04/09 22:26, Florian Weimer wrote:
(IMHO, the answer to the homograph issue is to give users better
indicators and tools to see what's going on.
I don't agree; that's pushing security decisions down to the user, which
is OK for 0.1% but bad for 99.9%, because they are not qualified, and do
not have the time, energy or inclination to become qualified, to learn
about the problem and make the decision.
That's OK as long as we are clear that Mozilla disclaims liability.
This is the "Know your Risks" thread where it is clear(er) that Mozilla
doesn't take any liability for use of certs.
Given that there is now less & low liability kick-back to Mozilla, it is
probably OK for Mozilla to make decisions about how to organise user
security. Including hiding the classical PKI security model from them,
for usability reasons. (Some would say that we should only make
decisions like that if we take on liability ... but this is an open
source org, with no financial relationship that would drive a liability
calculation. So zero liability is the only sustainable choice.)
As now that we are moving to a unified zero-liability position across
the security model (and Mozilla's risk is addressed) we could possibly
go to the next step, which is improving the delivered security as
opposed to the paper security.
iang
_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security
