Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla SSL policy bad for the Web

cs.uml.edu

Post reply on HN
Print view View original

21–30 of 89 posts

Re: Mozilla SSL policy bad for the Web

#21

Post by axod »

olavk wrote: post #5
axod wrote: post #3

SSL certificates for HTTPS are a big fat scam. Why do I need to pay money to get a certificate, just to provide encryption. Encryption should be separate from identity verification. Of course identity verification should be properly vetted and you should have to pay a fee, and have documents checked etc. If however, you just want to provide security for your users by encrypting http, you should not have to jump throu…

But what good is encrypted communication if you cant be sure who you are communication with?

Mainly it means that your employer/ISP/someone else using same lan/wifi etc can't sniff your packets.

Encryption is useful, and separate to identity verification.

Re: Mozilla SSL policy bad for the Web

#22

Post by axod »

sigstoat wrote: post #9
y0ghur7_xxx wrote: post #7

Earlier quoted context omitted.

It is good because that way you know that nobody in between can see your traffic. And more often than not it is enough to know that you are talking to the same site you talked to the last time (just like with SSH). The idea of "no lock icon" in case of a self signed/unknown CA certificate is a really good idea IMHO. The traffic is encrypted, but it does not give the user a false sense of security.

If you don't know who you're talking to, then there is no point in encrypting the data, because you're probably talking to the attacker. ("Man In The Middle") Now, the idea of "I'm talking to the same person I talked to last time" is useful, but if the users are all conditioned to accept random certificates without understanding, then when they go back a second time (and the attacker is waiting), they'll agree to the…

Regardless, it's still better than straight HTTP.

HTTP < Encrypted HTTP < Encrypted,signed HTTP

Re: Mozilla SSL policy bad for the Web

#23

Post by notauser »

grhino wrote: post #8

What's encryption without authentication? Encryption ensures that only the entity you are sending the message to can read it. If you can't be sure of the entity you are sending the message to, then what's the point of encrypting it in the first place? Why does the article pick out Mozilla in particular? Are they suggesting that FireFox makes it overly complex to ignore the warning and continue on?

Authentication takes two forms:

Am I talking to this guy.

Am I talking to the same guy as yesterday. << Anonymous certificates handle this use case.

Re: Mozilla SSL policy bad for the Web

#25

Post by [deleted] »

pdubroy wrote: post #4

Johnathan Nightingale of Mozilla has a good blog post explaining the rationale behind this: http://blog.johnath.com/2008/08/05/ssl-question-corner/ An especially pertinent point from his post: "Several CAs accepted by all major browsers sell certificates for less than $20/yr, and StartSSL, in the Firefox 3 root store, offers them for free."

[deleted]

Re: Mozilla SSL policy bad for the Web

#26

Post by sh1mmer »

ajross wrote: post #17
pdubroy wrote: post #4

Johnathan Nightingale of Mozilla has a good blog post explaining the rationale behind this: http://blog.johnath.com/2008/08/05/ssl-question-corner/ An especially pertinent point from his post: "Several CAs accepted by all major browsers sell certificates for less than $20/yr, and StartSSL, in the Firefox 3 root store, offers them for free."

That's not the bug though. The bug is that the error message a user sees when visiting a self-signed site using HTTPS is much more scary than simply visiting that site on an unencrypted connection, even though by all reasonable standards this is a safer, more private, and more secure action. If we're not going to warn folks about unencrypted links where every proxy in the way is a man-in-the-middle attack waiting to…

This is because users are being trained to use sites "with the yellow bar at the top" to do personal things (e.g logging in, credit card details, etc). Making users have to jump through a couple hoops of hoops if the certificate is self-signed is a good way to protect users that don't understand the technology.

While I understand you want to be very egalitarian about it most users would value their personal information's safety over the principle of a completely open web.

In the spirit of the open web you are free to a) not use Firefox b) fork the Firefox project c) file a bug with Firefox d) contribute to Firefox and argue for this feature to be removed

Re: Mozilla SSL policy bad for the Web

#27

Post by huhtenberg »

josefresco wrote: post #13
olavk wrote: post #5

Earlier quoted context omitted.

But what good is encrypted communication if you cant be sure who you are communication with?

What good is verified communication when you can buy an SSL cert with pretty much any fake information you want.

I'd like to know where I can buy a cert this way. Pretty please.

Re: Mozilla SSL policy bad for the Web

#29

Post by marketer »

Having a trusted third party is a pretty big deal in cryptography. Without it, many of the core assumptions of public-key cryptography are invalid. It's a huge part of making sure the other end is authentic. I'd place a lot more trust in Bank A's public key if it was signed by verisign, rather than an unverified third party. Having verisign's public key in my browser elimininates a large class of man-in-the-middle attacks.

If paying $20/year is too inconvenient for you to transfer your data securely, then perhaps the data isn't sensitive enough, and you shouldn't bother.

Re: Mozilla SSL policy bad for the Web

#30

Post by huhtenberg »

axod wrote: post #22
sigstoat wrote: post #9

Earlier quoted context omitted.

If you don't know who you're talking to, then there is no point in encrypting the data, because you're probably talking to the attacker. ("Man In The Middle") Now, the idea of "I'm talking to the same person I talked to last time" is useful, but if the users are all conditioned to accept random certificates without understanding, then when they go back a second time (and the attacker is waiting), they'll agree to the…

Regardless, it's still better than straight HTTP. HTTP < Encrypted HTTP < Encrypted,signed HTTP

Actually, no. For all practical intents and purposes encryption w/o authentication is as good as no encryption.

Unauthenticated encryption is 'better' than a plaintext in just one thing - it protects against passive snooping. Anyone willing to splice the connection will have full access to all your plaintext data and you won't even know about it. As such it's nothing more than an equivalent of reversible traffic obfuscation.

So if your "better" meant "obfuscated", then, yeah, it's better. But it's no more secure (in a conventional security sense) than a plaintext.

Post reply on HN