Ka-Ping Yee wrote:
Refusing to accept self-signed certificates is *not* the right thing
to do. That would only further the notion that buying a certificate
from one of dozens of approved CAs is what makes a website legitimate,
which is false.
What fraction of the 30 to 50 root CAs on your root CA list do you
know or have ever heard of? Do you know their policies? Do you know
their management? Why should you trust them?
What makes a website legitimate is the fact that it is the website
you truly intended, not the fact that it happens to have paid a member
of the CA extortion ring.
What other way does the average non-technical user have to know that the
secure website is the one truly intended and not a fake, except than to
rely upon a third party to do the verification for them ? Self-signed
certs certainly don't provide any of that type of assurance.
The only valid exception may be when you are connecting to your own
hosts over a very controlled private network. In this case no third
party verification is necessary. But most non-technical users don't do that.
_______________________________________________
mozilla-crypto mailing list
[email protected]
http://mail.mozilla.org/listinfo/mozilla-crypto
