LWN.net Logo

Firefox 3 SSL certificate warnings

Firefox 3 SSL certificate warnings

Posted Sep 4, 2008 15:28 UTC (Thu) by obi (guest, #5784)
Parent article: Firefox 3 SSL certificate warnings

The value of a self-signed cert is that
1) your traffic is still encrypted
2) you can detect if the cert has changed

So, I would just do what other people have suggested, which is, make no UI changes (no padlock, yellow or green bar, etc) for self-signed https, pretty much like with plain http; but store the cert the first time you connect. If the cert changed on a later visit, raise the alarm bells.

While it still wouldn't provide perfect security (especially if it's the first time you connect) - the point is to:
1) not give the illusion of security (same as plain http)
2) provide some protection against casual sniffing
3) provide some detection of MITM attacks (providing it's not the first visit)


(Log in to post comments)

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds