Linked by Thom Holwerda on Fri 29th Aug 2008 13:23 UTC, submitted by irbis
Mozilla & Gecko clones Firefox 3.0, released not too long ago, was generally well-received. It added a load of new features, while also providing much-needed speed improvements and better memory management. Some new features, however, have met more resistance - one of them is the rather complicated user interface thrown at users when they reach a website with an invalid or expired SSL certificate.
Thread beginning with comment 328538
To read all comments associated with this story, please click here.
voidspace
Member since:
2008-06-25

https is used for two different reasons - encryption and identification.

If you are connecting to a site that you don't really know then identification serves no purpose *anyway* but encryption may be very useful.

I would say that in *most* cases it is the encryption that people use https for.

Firefox is insisting on both. Their exception system is basically unusable - awful.

Reply Score: 2

flypig Member since:
2005-07-13

It's worth bearing in mind, though, that without certificate authentication there's the possibility of someone performing a man-in-the-middle attack (e.g. I sit in the middle of the connection between you and your bank, decrypting the data with my self-signed certificate and then re-encrypting it with your bank's certificate). This means that your apparently encrypted link isn't actually as secure as it looks.

Because of this the authentication part is needed for fully secure encryption too.

I'd still agree that a self-signed certificate used for encryption is better than using no encryption at all.

Reply Parent Score: 3

intangible Member since:
2005-07-06

My solution:
Two separate warnings:
1. Invalid or expired certificates: always bad... like current behavior
2. Self-signed or unknown certificate authorities: allow a simpler way to accept cert on first visit to a site (with some explanation about how only encryption is enabled but no identity verification has been done), but keep track whenever a site's certificate has changed on subsequent visits and show warning about man-in-middle attacks.

Easy!

Edited 2008-08-29 23:41 UTC

Reply Parent Score: 3

Panajev Member since:
2008-01-09

If you are connecting to a site that you don't really know then identification serves no purpose *anyway* but encryption may be very useful.


I'd say that encryption would be quite useless in this case unless you are worried that people sniffing on the network might laugh too loudly at the crap the untrusted site is exchanging with you ;) .

Reply Parent Score: 1

braddock Member since:
2005-07-08


I'd say that encryption would be quite useless in this case unless you are worried that people sniffing on the network might laugh too loudly at the crap the untrusted site is exchanging with you ;) .


The content you are exchanging without encryption or strong authentication is still enough to put you in jail or on a watchlist in many countries.

Nearly ALL internet traffic should be encrypted. Period.

A man-in-the-middle attack is 10 times harder than sniffing, is easily detectable, and has legal implications which require a warrant for governments in most countries.

We've lost a lot of ground since 10 years ago when the FreeS/WAN project seriously aimed to get most routine internet traffic encrypted by now and PGP was slowly becoming an accepted mail protocol.

Reply Parent Score: 1