Firefox 3 SSL certificate warnings [LWN.net]

Firefox 3 SSL certificate warnings

Posted Aug 28, 2008 16:06 UTC (Thu) by docwhat (guest, #40373)
Parent article: Firefox 3 SSL certificate warnings

From the user point of view, isn't a self-signed certificate equal to unencrytped? So why point out the certificate at all?

Just have the UI make no change to the status (don't add the padlock icon, etc.); have the UI pretend it's an http site.

Ciao!

to post comments

Firefox 3 SSL certificate warnings

Posted Aug 29, 2008 16:11 UTC (Fri) by giraffedata (guest, #1954) [Link] (4 responses)

From the user point of view, isn't a self-signed certificate equal to unencrypted?

Self-signed is better than unencrypted because with unencrypted, an eavesdropper can get your password. With self-signed, he can't.

But with respect to impostors and men in the middle, they're equivalent.

Simply not displaying any claim of security, as you suggest, for the self-signed certificate is probably better than the dire warning. But it would also be nice to see some icon that tells me that, while I might be talking to an impostor, at least no one can eavesdrop on me. Since it's significantly harder for someone to intercept my traffic than just look at it, there are things I would risk in that case that I wouldn't risk on a totally unencrypted connection.

However, I don't know that there's any practical way to make the average user understand this mid-level security. So by default, it would be better to make no claim at all.

Firefox 3 SSL certificate warnings

Posted Aug 29, 2008 18:03 UTC (Fri) by docwhat (guest, #40373) [Link]

As you say, though, you don't know about impostors or men-in-the-middle. You know at least part of the traffic is encrypted, but you don't what part and if it matters or not.

That's why I would consider them equivalent.

Ciao!

Firefox 3 SSL certificate warnings

Posted Aug 30, 2008 1:57 UTC (Sat) by njs (subscriber, #40338) [Link] (2 responses)

> But with respect to impostors and men in the middle, they're equivalent.

Sometimes. But usually not... The most valuable thing about a self-signed certificate from my point of view is that you can detect when the cert changes -- so if someone hijacks your connection to a site you've used before, you *know*. This describes the vast majority of sites that I trust with sensitive information -- I have a relationship with them! And even if your first visit to some site gets hijacked, whenever you visit that site again later you will at least discover that it happened (because the real non-hijacked connection will use a different cert than you're expecting).

Firefox 3 SSL certificate warnings

Posted Aug 30, 2008 2:11 UTC (Sat) by giraffedata (guest, #1954) [Link] (1 responses)

The most valuable thing about a self-signed certificate from my point of view is that you can detect when the cert changes

Good point.

But as a practical matter, is there any web browser that detects that? I appreciate that the two SSH clients I use do, but I thought web browsers didn't. I assume that the fact that one visits a lot more web sites than shell sites has a lot to do with it.

Firefox 3 SSL certificate warnings

Posted Aug 30, 2008 9:04 UTC (Sat) by njs (subscriber, #40338) [Link]

> But as a practical matter, is there any web browser that detects that?

No, sigh.

Well, you'll get the "it's self-signed, make an exception or run and hide?" dialogs again when the cert changes, but there's no notification that you *already* made an exception, so you'll probably treat it the same way you treat all the other dialogs like that, i.e. curse and click through.