| |||||||||||||
SSL certificates and MD5 collisionsSSL certificates and MD5 collisionsPosted Jan 17, 2009 19:55 UTC (Sat) by bronson (subscriber, #4806)In reply to: SSL certificates and MD5 collisions by HenrikH Parent article: SSL certificates and MD5 collisions
Sorry, I misread your suggestion. I thought you were suggesting a CRL-like behavior. If you're just talking about adding an SSH-like warning, and not manipulating or revoking the certificates on the browser itself, then I take back what I said.
Of course, the SSH warning has been shown to be fairly ineffective in the real world. And that's with sysadmins who should know better! What about regular people? When presented a dialog box saying "The certificate for Chase Bailout Bank has changed! Do you want to continue?" I would guess that 99 out of 100 of them would simply click "Yes."
But, I agree, it wouldn't hurt.
(Log in to post comments)
SSL certificates and MD5 collisions Posted Jan 20, 2009 9:33 UTC (Tue) by HenrikH (guest, #31152) [Link]
That is exactly my suggestion, to add a SSH-like warning. Agreed that not many people would benefit from it, but I know that I would :-)
|
|||||||||||||