Mozilla SSL policy bad for the Web
cs.uml.edu
Mozilla SSL policy bad for the Web
1–10 of 89 posts
Re: Mozilla SSL policy bad for the Web
#2"Snooping a connection (i.e. on a wireless link) is much easier than any of the impersonation attacks that SSL authentication prevents."
I wouldn't be so sure about that.
Re: Mozilla SSL policy bad for the Web
#3SSL certificates for HTTPS are a big fat scam. Why do I need to pay money to get a certificate, just to provide encryption.
Encryption should be separate from identity verification.
Of course identity verification should be properly vetted and you should have to pay a fee, and have documents checked etc.
If however, you just want to provide security for your users by encrypting http, you should not have to jump through hoops and spend money.
Re: Mozilla SSL policy bad for the Web
#4Johnathan Nightingale of Mozilla has a good blog post explaining the rationale behind this:
http://blog.johnath.com/2008/08/05/ssl-question-corner/
An especially pertinent point from his post:
"Several CAs accepted by all major browsers sell certificates for less than $20/yr, and StartSSL, in the Firefox 3 root store, offers them for free."
Re: Mozilla SSL policy bad for the Web
#5SSL certificates for HTTPS are a big fat scam. Why do I need to pay money to get a certificate, just to provide encryption. Encryption should be separate from identity verification. Of course identity verification should be properly vetted and you should have to pay a fee, and have documents checked etc. If however, you just want to provide security for your users by encrypting http, you should not have to jump throu…
But what good is encrypted communication if you cant be sure who you are communication with?
Re: Mozilla SSL policy bad for the Web
#6Also, you can see the "add an exception" in the screen shot. You can manually add an SSL certificate to a white list, it's just a little bit harder, with a few more steps, than the previous YES|NO dialogue.
I think this a good thing. 99% of user probably don't need to or shouldn't interact with pages with self-signed certificates. That's a good thing. Self-signed certs should really only be on development pages. I'm sure this is a good anti-phishing measure.
Re: Mozilla SSL policy bad for the Web
#7SSL certificates for HTTPS are a big fat scam. Why do I need to pay money to get a certificate, just to provide encryption. Encryption should be separate from identity verification. Of course identity verification should be properly vetted and you should have to pay a fee, and have documents checked etc. If however, you just want to provide security for your users by encrypting http, you should not have to jump throu…
But what good is encrypted communication if you cant be sure who you are communication with?
It is good because that way you know that nobody in between can see your traffic. And more often than not it is enough to know that you are talking to the same site you talked to the last time (just like with SSH).
The idea of "no lock icon" in case of a self signed/unknown CA certificate is a really good idea IMHO. The traffic is encrypted, but it does not give the user a false sense of security.
Re: Mozilla SSL policy bad for the Web
#8What's encryption without authentication?
Encryption ensures that only the entity you are sending the message to can read it. If you can't be sure of the entity you are sending the message to, then what's the point of encrypting it in the first place?
Why does the article pick out Mozilla in particular? Are they suggesting that FireFox makes it overly complex to ignore the warning and continue on?
Re: Mozilla SSL policy bad for the Web
#9Earlier quoted context omitted.
But what good is encrypted communication if you cant be sure who you are communication with?
It is good because that way you know that nobody in between can see your traffic. And more often than not it is enough to know that you are talking to the same site you talked to the last time (just like with SSH). The idea of "no lock icon" in case of a self signed/unknown CA certificate is a really good idea IMHO. The traffic is encrypted, but it does not give the user a false sense of security.
If you don't know who you're talking to, then there is no point in encrypting the data, because you're probably talking to the attacker. ("Man In The Middle")
Now, the idea of "I'm talking to the same person I talked to last time" is useful, but if the users are all conditioned to accept random certificates without understanding, then when they go back a second time (and the attacker is waiting), they'll agree to the new cert, just like they did the first time.
Re: Mozilla SSL policy bad for the Web
#10"Snooping a connection (i.e. on a wireless link) is much easier than any of the impersonation attacks that SSL authentication prevents." I wouldn't be so sure about that.
> I wouldn't be so sure about that.
Umm, I would. Running Wireshark or tcpdump to sniff traffic over the wire is easy, and analysis can be done offline at the attacker's leisure.
Hijacking DNS and phsishing for users' login credentials to other sites requires a lot more preparation, and in most cases, prior selection of the desired target sites.