4 ms·
While your frustration is understandable, I think you're speaking from the perspective of a tech-savvy person and not the average user. If browsers began accept
by kijinbear 16y ago
While your frustration is understandable, I think you're speaking from the perspective of a tech-savvy person and not the average user. If browsers began accepting all free / self-signed certificates, it would be only a matter of time before something like "Firesheep FX" came along and permitted random strangers to MITM anybody's SSL session. Some of us can notice when that happens, but most people won't have a clue unless the browser presented them with a big scary red warning.
However, I agree with you that we need some good free CAs. The difference between free and $10/year is bigger than most of us think it is. Fortunately, there are registrars such as Gandi which will give you free certificates with every domain.
- Udo 16y ago> If browsers began accepting all free / self-signed certificates [...] Right now, browsers are accepting any unencrypted old HTTP connection without any warning, while non-verified securely encrypted connections are actively prevented. Tech people can circumvent the block, but normal users cannot. Nor do they have any reason to because the warning they are being shown sounds like the end of the world, while any unsecured connection looks perfectly fine to them. This is something that could be done right now to make everybody more secure, at no cost, but it threatens the business model of companies like Verisign. Nobody is suggesting that browser makers should display the much-sought-after "lock of absolute protection" icon on any random SSL connection, I'd be fine if they reserve that for paid-for-certs. I'm merely suggesting they show free (or even self-signed) certs the same courtesy as basic HTTP, the most permissive protocol of all time, instead of actively preventing users from using encryption. I agree with you about the threat of "Firesheep FX" and believe Wifi connections should probably all use WPA2, even at coffee shops where internet access is free. The threat of MITM is real, but the attack can be made more difficult using a number of schemes, and it even includes free certs that offer way more protection than any unencrypted link ever could. Yet, we are currently encouraging unencrypted connections while actively blocking encrypted ones. If HTTPS could have the same UI mechanisms as, say, an SSH connection I'm convinced the online world would be a much safer place.
- nikcub 16y agoWifi connections should probably all use WPA2, even at coffee shops if you just write the password on the wall, it defeats the purpose - everyone who logs in is on the same network again, just like a public network
- deleted 16y ago[deleted]
- eru 16y agoEveryone being on the same network isn't too much of a problem. They still can't read each others traffic. See http://en.wikipedia.org/wiki/IEEE_802.11i-2004 http://en.wikipedia.org/wiki/IEEE_802.11i-2004 or http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#WPA2 http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#WPA2 Every device negotiates its own keys with the access point.
- hannibalhorn 16y agoVery common misconception, but it's still a problem. Any client with the network password can capture the initial key negotiation, and then decrypt the client's subsequent traffic. You can enter the network password in Wireshark: http://wiki.wireshark.org/HowToDecrypt802.11 http://wiki.wireshark.org/HowToDecrypt802.11 .
- nikcub 16y agoye I should clarify and add that it means you can see the traffic. even if it is switched
- michaelhart 16y ago> The difference between free and $10/year is bigger than most of us think it is. > I agree with you that we need some good free CAs https://www.startssl.com/ https://www.startssl.com/ Supported by just about every browser. Entirely free. A fellow Hacker News user linked to it in a similar thread. I was impressed :)
- kijinbear 16y agoLast time I checked, StartSSL was not recognized by some (slightly old) browsers. I wonder if this issue has been resolved now?
- michaelhart 16y agoTheir root CA was generated in 2006. In theory, any browser shipped before 2006 will not support it unless it was added (through, for example, Windows Updates).IE7+ is supported; I haven't tested (and don't care to test) IE6.
- c00ki3s 16y agoAbout 3 years back I used them and back then ie6 didnt' work out of the box. And the windows root cert update didn't help either back then.
- deleted 16y ago[deleted]