   Firefox about certificates
  Sometimes when entering a website, mozilla firefox or mozilla complain about the certificate being invalid, and you have to click vareous things like "ok, yeah, ignore, continue, ...." before you can finally reach the website.If I'd send personal information to the internet, then I agree it should warn me about certificates!But when just wanting to read a website, without even logging in, what's the idea behind all this? The website sends its HTML to my browser, why not make it visible to me? It's sloppy of people to not update certificates of their website if they decide to have them, but I think the browser should only disallow entering information into it, but allow viewing it...   
  SSL works both ways; what if you were viewing a page that listed bank details, for example? You'd want that to be encrypted.   ;  That's funny, you both have Pink Floyd album cover icons.   ;  ben, Lode: It's still encrypted both ways. The strength of the certificate has nothing to do with it being "invalid" which merely means that it wasn't signed by a certificate authority that Mozilla recognizes. You'll find this happening with sites using certificates from CAcert (unless you manually add in their CA certificates into Firefox or SeaMonkey), and likewise with self-signed certificates.It's the same thing with Authenticode; programs signed using a certificate not signed by a CA recognized by Microsoft still come up as unknown publisher.All the signing does is give you a bit more faith that the site is run by who it says it's run by. All the certificates themselves do is provide a basis for key exchange for encrypted communications.Mith: Just noticed that now?   ;  A certificate from an untrusted authority is vulnerable to man-in-the-middle attacks - eliminating that vulnerability is the whole point of public key infrastructures in the first place.   ;  Coldacid is correct; the encryption of the data being sent during that session is intact.  It is only the identity of the web site owner whom you should be concerned with.When I last applied for an SSL cert (a while back, to be sure) I had to provide all sorts of credentials about who I was, who my company was (Articles of Incorporation, list of members of the Board, etc.), what domain we intended to use the certificate on, what purpose we would be using the secure transmissions for, etc.  What the invalid certificate means is that the identity presented by the website could not be verified, or that the identity has been verified but not by a trusted root.Quote:Original post by ExtrariusA certificate from an untrusted authority is vulnerable to man-in-the-middle attacks - eliminating that vulnerability is the whole point of public key infrastructures in the first place.With the recent DNS flaws this is more of a concern than ever before.   ;Quote:Original post by ExtrariusA certificate from an untrusted authority is vulnerable to man-in-the-middle attacks - eliminating that vulnerability is the whole point of public key infrastructures in the first place.Even "trusted" authorities are vulnerable to this; some get their CA status from Apple or Microsoft in exchange for big sums, and a few have been known to not be very thorough at all in determining the validity of an entity to whom they issue certificates. (I'm looking at you, Verisign!)I'm hoping that Mozilla will start including CAcert as a trusted root authority, and sooner rather than later. There've been some shake-ups with how identities are verified, in order to meet certain standards that the Mozilla Foundation demands. Considering that the only way to get Microsoft to list someone as a trusted root is with a load of cash, I don't hold out much hope that CACert will be listed by them, however.   ;Quote:Original post by coldacidQuote:Original post by ExtrariusA certificate from an untrusted authority is vulnerable to man-in-the-middle attacks - eliminating that vulnerability is the whole point of public key infrastructures in the first place.Even "trusted" authorities are vulnerable to this; some get their CA status from Apple or Microsoft in exchange for big sums, and a few have been known to not be very thorough at all in determining the validity of an entity to whom they issue certificates. (I'm looking at you, Verisign!)[...]A trusted authority prevents arbitrary man-in-the-middle attacks - the person must get a valid certificate with a specific false identity (matching the one you want to actually deal with) in order to be a man-in-the-middle.Without a trusted authority (self-signed certificates, unknown authorities, etc), anybody can be a man-in-the-middle because there is no requirement to have external validation of any kind when you accept arbitrary certificates (they just intercept the real one, copy the name/etc to their generator, and send off a certificate with the same name, their own signing, and happily read all your data as you trust their certificate).   ;Quote:Original post by ExtrariusQuote:Original post by coldacidQuote:Original post by ExtrariusA certificate from an untrusted authority is vulnerable to man-in-the-middle attacks - eliminating that vulnerability is the whole point of public key infrastructures in the first place.Even "trusted" authorities are vulnerable to this; some get their CA status from Apple or Microsoft in exchange for big sums, and a few have been known to not be very thorough at all in determining the validity of an entity to whom they issue certificates. (I'm looking at you, Verisign!)A trusted authority prevents arbitrary man-in-the-middle attacks - the person must get a valid certificate with a specific false identity (matching the one you want to actually deal with) in order to be a man-in-the-middle.Considering that for most trusted authorities to get that status need to merely pay some cash to Apple and Microsoft, it's not that far-fetched that one might be lax about who they issue certificates to, and in whose name. Therefore a trusted root is only nominally more secure than an untrusted one.I could go with a lump of cash and some information about a business I downloaded off the internet, go to one of those lazy CAs, and voilà, I now have a perfectly valid certificate with which I can spoof.I tend not to trust SSL certificates for anything more than encrypting communications.   