| |||||||||||||
Sovereign Keys for certificate verificationSovereign Keys for certificate verificationPosted Dec 30, 2011 14:09 UTC (Fri) by Lennie (subscriber, #49641)In reply to: Sovereign Keys for certificate verification by ras Parent article: Sovereign Keys for certificate verification
"You could for example exchange a cert for all future communications, and thus no longer need to trust the PKI system to set up secure communications."
Well, Chrome does support pinning [0] and several browsers support HSTS.
What if servers could send a header which gives the client enough information so it can do pinning (for a set amount of time similair to HTST).
There seems to be some work being done on that, like TACK [1]
[0] http://www.imperialviolet.org/2011/05/04/pinning.html
__
"The initial connection is set up using PKI as now, but the only thing that is used for is to get the user to identify themselves using some credentials, and then sending the signin bookmark to the users browser, which stores it. The browser than lets the user to click on the signin bookmark, which invokes a procedure that signs the user into the web site, as the name implies. Thus it contains a URL just like a normal bookmark."
Just letting users know they should bookmark their banking site would probably be an improvement as it is now. ;-)
Anyway, maybe it could be combined with BrowserID [2] ?
Mozilla has been wanting to add login-support like so to the browser for years now (random example of what it might look like): http://www.extremetech.com/wp-content/uploads/2011/07/fir...
They started in 2009 with OpenID but OpenID didn't work so they've now created BrowserID/Verified Email Protocol.
[2] https://browserid.org/
"Iraq CA hack"
Did you mean Iran ?
__
"..that nonetheless works in much the same way are on the wrong track entirely"
I've seen a couple of proposals, but they all end up lost in the edges you talk about. Simply because of one thing: backwardcompatibility
Here is random example, because I already had the imperialviolet site open: http://www.imperialviolet.org/2011/06/16/dnssecchrome.html
A fairly small change in the browser, but older browsers can't connect to it and use the current CA system as a fallback or similair.
Not having backwardcompatibility is like the network effect reversed.
(Log in to post comments)
Sovereign Keys for certificate verification Posted Dec 30, 2011 17:15 UTC (Fri) by raven667 (subscriber, #5198) [Link] A fairly small change in the browser, but older browsers can't connect to it and use the current CA system as a fallback or similair. Not having backwardcompatibility is like the network effect reversed. Here is where the browsers policy of rapid release auto updates could help by getting the code out there and widely deployed quickly so that maybe in a year 99% of the clients are compatible and you can move forward.
Sovereign Keys for certificate verification Posted Dec 30, 2011 21:02 UTC (Fri) by Lennie (subscriber, #49641) [Link]
"Here is where the browsers policy of rapid release auto updates could help by getting the code out there and widely deployed quickly so that maybe in a year 99% of the clients are compatible and you can move forward."
That will not happen, not even in 3 years. I've been building "webapplications" (among other things) for over 10 years.
Certain companies have only recently upgraded from IE6 to IE7.
Sovereign Keys for certificate verification Posted Dec 31, 2011 3:50 UTC (Sat) by raven667 (subscriber, #5198) [Link]
It's already happening. MS has already stated that they are making IE an auto-update item so I expect IE6 usage to drop precipitiously. IE6 is kind of a special, historical, case. New browsers have switched or will switch to an auto update system so that old versions won't hang around long.
Sovereign Keys for certificate verification Posted Dec 31, 2011 15:17 UTC (Sat) by Lennie (subscriber, #49641) [Link]
1. I mentioned 3 years, because of atleast IE6, IE7, IE8 to be banned from the public Internet. Probably (a lot ?) more.
2. Microsoft not only added auto update, they also added a really easy switch to turn it off at businesses. It isn't the home users which are the IE6 problem.
Sovereign Keys for certificate verification Posted Jan 4, 2012 5:50 UTC (Wed) by raven667 (subscriber, #5198) [Link]
Actually its better than I thought, IE6 usage in the US and much of Europe has fallen below 1%, the only thing propping up the total numbers is the vast number of pirated WinXP in China that doesn't get updates.
http://windowsteamblog.com/ie/b/ie/archive/2012/01/03/the...
|
|||||||||||||
