I knew there was something else I forgot to mention: Re my comments on the typical user, the language about typical users not voluntarily displaying security-related information is really a fancy way of saying that typical users are not going to be clicking on lock icons and inspecting the details of certificates, except possible when they get a warning message that offers them an option to "view certificate" (and even then they may not take advantage of this offer, or know what to make of it).
I agree with this. Also, I think we are pretty much all agreed that the typical user clicks through the warnings, regrettably, far more than they should.
Thus arguably the only cert- and CA-related things that matter to typical users are things that would cause a warning message to be displayed to the user given default preference settings.
I.e., I'd say:
"Thus the only cert- and CA-related things that matter to typical users are things that are displayed directly by the application, or, would cause a warning message to be displayed.
There are two assumptions here: Firstly, only default preference settings apply to this discussion, and also, all of it is arguable.
So a "typical user" profile is one who"
* does not adjust the security settings,
* tends not to take opportunities to read
cert information, even when offered, * tends to click through warnings without
understanding, * does not understand in general how the
security model works.According to my mind, others to differ. The first is a definitional thing - if they are keen enough to adjust the security settings, then by definition, they are out of the domain of our "typical user" and they can look after themselves.
> If, for
example, a CA issues a cert with false information, but the false information is for attributes whose values are not checked by Mozilla or displayed to the typical user by default, then as far as the typical user is concerned the truth or falseness of the information is irrelevant, and looking at it from the point of view of a typical user arguably there is little or no point in having CA evaluation criteria relating to verification of that information
OK. Although, it raises some interesting questions, in that it means a CA could issue a cert with all the "hidden" fields being rubbish, and still be entirely acceptable.
I guess as long as Disney, the company, gets www.disney.com on the domain in the cert, then we don't care if the fields say, Micky Mouse, Fantasy Castle, Never Never Land, as the address fields?
Logically, I think that's correct, as the address fields are not relied upon by the app. But I guess a lot of people would be uncomfortable with it.
iang _______________________________________________ mozilla-crypto mailing list [EMAIL PROTECTED] http://mail.mozilla.org/listinfo/mozilla-crypto
