Re: [TLS] TLS, PKI,

[Martin Rex <[e-mail]>]

Robert Relyea wrote:
> 
> It seems these are complaining about yesterday's UI. Most browsers no
> longer use pop-up menus. You have to be quite aggressive to get through
> the current screens.
> 
> The real problem, of course, is those sites that don't have valid certs.
> Continuing to ratched down the ability to get to those sites is good for
> the internet as a whole. Sites with invalid certs are just as dangerous
> for the internet as MITM sites.


The most significant effect of this UI change is that it strengthens
the oligopol and business model of commercial CAs.  The security
benefit probably negative.

This change has made the nursing problems of people experimenting
with this technology a magnitude worse.
So a lot of people are less likely to experiment with setting
up TLS on their server out of curiosity.

And the social engineering workaround for the attackers to first
feed the Browser a new CA-Cert (which results in a much less
scary popup), with the result that now certs for every server
can be forged -- which is a magnitude worse than users accepting
an untrusted server cert for a specific server-only (minus browser
bugs in what servers they accept the user-override for).

The german description for this is "das Kind mit dem Bade ausschütten"
(throw out the baby with the bathwater).

If SSHv1 would have required CA-signed X.509 certs in its initial
shipment, it would have taken MUCH longer to become popular, if at all.


-Martin