Re: Germany's cyber-security agency [BSI] recommends Firefox as most secure browser

2019-10-19 Thread scott.helme--- via dev-security-policy
> If I’m right, they might get upset with the removal of the UI. Hey Paul, To the best of my knowledge the UI isn't being removed, it's simply being moved to another location. If a consumer wishes to continue viewing the EV UI they can with a simple, single click. As a result, this shouldn't b

Re: Germany's cyber-security agency [BSI] recommends Firefox as most secure browser

2019-10-18 Thread scott.helme--- via dev-security-policy
> I hope the Mozilla community will celebrate this honor, but will also > reconsider its proposal to drop support for EV certificates – that would mean > that Firefox no longer meets all BSI requirements for a secure browser. Hey Kirk, Can you link to where Mozilla (or any other browser vendor

Re: Fwd: Intent to Ship: Move Extended Validation Information out of the URL bar

2019-08-19 Thread scott.helme--- via dev-security-policy
> > What evidence or research shows that the new location is providing better > protection for the end users? What evidence or research shows that any location provides any protection for the end users? ___ dev-security-policy mailing list dev-securit

Re: Trustico code injection

2018-03-01 Thread scott.helme--- via dev-security-policy
On Thursday, 1 March 2018 15:32:56 UTC, Alex Gaynor wrote: > For the Trustico folks: > > While I imagine you're quite busy remediating this serious issue: Can you > state whether it would be possible to access any of the private keys you > store using this root shell? > > Alex > > > On Thu, Ma

Re: On the value of EV

2017-12-12 Thread scott.helme--- via dev-security-policy
I recently talked about [1] some of the many problems I see with EV certificates on my blog but looking at the tangible security benefits of EV they can already be matched, or will soon be matched, by DV certificates. Certificate Transparency will be required [2] for all certificates and not ju