J. Greenlees wrote:
3. Consider these three cases:
(a) Unencrypted connection.
(b) SSL connection with a self-signed certificate.
(c) SSL connection with a certificate signed by a known CA.
Of these three options, (a) is the riskiest context in which
to submit an HTML form; (b) and (c) are safer. (If you trust
centralized CAs, then you might also believe that (c) is safer
than (b). I *don't* trust the CAs, but that is an issue for
a separate thread. In any case, i hope we can agree that (b)
is still safer than (a).)
Compare this ranking of risk to the user experience. (b) is
heavily penalized by a pop-up warning, but (a) and (c) are
not penalized at all. It may be worth thinking about how to
bring these user-experience costs more in line with the actual
risks, so that sites are encouraged to use encryption without
being required to pay the extortion^H^H^H^H^H^H^H^H^Hfees
demanded by centralized CAs.
since most CA will issue certificate of your site and security based
solely on the fact that you paid for the cert, I wouls also have to
agree that CA issued does not meant trusted.
I would disagree that a self issued cert makes you more trusted.
I don't believe he said that it would. He used the word
'safer' and he compared it to (a) unencrypted connection!
the issuing of certs needs to be re-examined, and some sort of viable
system worked out to protect end users from fraudulent use.
! Who's going to do that?
far beyond the scope of any one development team, though maybe getting
security teams from most development groups to work together on a sane
security standard, with better control over certificates issued.
I have tried to contact two (other) security teams on
issues like this, and I got ignored :) Maybe you'll
have better luck. Please report any useful results
here!
( control as in verified identity and, as much as possible, good
business peractices )
Those words have little or no meaning in the
context of browsing security across the world.
iang
--
News and views on what matters in finance+crypto:
http://financialcryptography.com/
_______________________________________________
Mozilla-security mailing list
[email protected]
http://mail.mozilla.org/listinfo/mozilla-security
