Nelson B wrote:
b) what should each application do about them? (this is obviously a set
of questions, one per application.)
... The question then is, what
will the application(s) do with the info in this extension, if anything?
Now, recall that MoFo has no "security director" who decides how crypto
security policy affects UI. And worse, it has no developer who is
actively working on the crypto UI (PSM is an orphan). So, I am raising
the question that might otherwise be decided by that director or PSM
owner, if one existed.
OK.
I am hoping that the FireFox and ThunderBird UI czars will read this
thread in this group, and engage in discussion of this issue.
Ian, you've championed the idea of making crypto security less "binary"
in the UI, so I'd expect you to also like this idea, making a stated
limit of liability clear to the user whose money (and "security")
is on the line.
Well! Many thoughts are bubbling away, and I might
be weeks away from feeling certain on this issue. But,
here's some thoughts:
1. The crypto layer really should be clean and sweet.
Taking responsibility for an open ended-policy feature
in certs would not seem to be in accord with that.
2. The notion that someone can create a cert that has
a "break if you don't understand this" setting - the critical
bit - raises a whole host of security questions that I for
one do not see as answered.
Pausing for a moment here ... are these viewpoints that
the NSS team has already reached, and can be used
as "current viewpoints" ... or is there further debate?
3. The policy question that is being asked - please
show the user this statement - seems to be quite a
reasonable one. It is in line with current security
thinking that any security system has to consider
the user as an essential component in it. What the
policy statement indicates fits well with that.
4. In fact, the policy statement has simply been lifted
from standard european practice with cheque guaruntee
cards, I would guess. There, to combat cheque fraud,
banks would issue plastic cards that had a value on
them that would guaruntee any transaction to that
amount as long as the shop copied the number onto
the cheque. (I say European, I've only seen it in Britain).
5. Giving the CA an ability to show some statement to
the user seems like a worthwhile goal.
6. How this request comes about - the European legal
environment - raises some really interesting questions.
I'm hoping that any solution devised can be as neutral
as possible here.
7. I read comment #17 in the bug report to say that
Opera and IE both take no action on the certs, other
than displaying the information if the user knows how
to dig that far.
iang
--
News and views on what matters in finance+crypto:
http://financialcryptography.com/
_______________________________________________
Mozilla-security mailing list
[email protected]
http://mail.mozilla.org/listinfo/mozilla-security
