4 ms·

Johnathan Nightingale of Mozilla has a good blog post explaining the rationale behind this: http://blog.johnath.com/2008/08/05/ssl-question-corner/ http://blog

by pdubroy 18y ago

Johnathan Nightingale of Mozilla has a good blog post explaining the rationale behind this: http://blog.johnath.com/2008/08/05/ssl-question-corner/ http://blog.johnath.com/2008/08/05/ssl-question-corner/ An especially pertinent point from his post: "Several CAs accepted by all major browsers sell certificates for less than $20/yr, and StartSSL, in the Firefox 3 root store, offers them for free."

halo 18y ago
Doesn't change the fact that it pops up a scary unintelligible message and makes you jump through hoops whenever someone tries to visit a site with a self-signed certificate. It's very much a "break the web" situation. As suggested by the original article, the correct behaviour would be to treat it as though there's no security whatsoever. After all, logically, how is being encrypted but unauthenticated worse than being unencrypted and unauthenticated?
- tptacek 18y ago
  How can your browser tell the difference between: (1) A connection to onlinebanking.bankofamerica.com in which an attacker has hijacked the SSL handshake and subbed in a self-signed certificate, and (2) A connection to https://login.ratemykitten.com https://login.ratemykitten.com? You appear to be arguing that the warning for this situation should be tuned to (2).
ajross 18y ago
That's not the bug though. The bug is that the error message a user sees when visiting a self-signed site using HTTPS is much more scary than simply visiting that site on an unencrypted connection, even though by all reasonable standards this is a safer, more private, and more secure action. If we're not going to warn folks about unencrypted links where every proxy in the way is a man-in-the-middle attack waiting to happen, why are we going through such contortions to warn them about the same attacks in a situation where they are much harder to accomplish? I've never understood this warning at all.
- sh1mmer 18y ago
  This is because users are being trained to use sites "with the yellow bar at the top" to do personal things (e.g logging in, credit card details, etc). Making users have to jump through a couple hoops of hoops if the certificate is self-signed is a good way to protect users that don't understand the technology. While I understand you want to be very egalitarian about it most users would value their personal information's safety over the principle of a completely open web. In the spirit of the open web you are free to a) not use Firefox b) fork the Firefox project c) file a bug with Firefox d) contribute to Firefox and argue for this feature to be removed
  - Herring 18y ago
    Yeah it's a branding issue. The yellow bar or the lock at the bottom should indicate a "secure" site. A self signed cert is no different from a fraudulent cert.
- tptacek 18y ago
  The warning says, "Here is a site that claims to be secure. Maybe you thought it was secure, maybe you didn't. Either way, the site is not secure. DO NOT ENTER YOUR PASSWORDS AND CREDIT CARD NUMBERS HERE." The warning is vibrant because the condition it reports on can be created by an attacker on any SSL connection. That stupid warning might be among the top five security mechanisms on the Internet.
  - ajross 18y ago
    Why is a self-signed site insecure? Why isn't an HTTP site with a credit card prompt equally insecure (please, don't try to tell me that users look at the yellow bar -- we all know from direct experience that they don't)? Why is a properly certed site known to be secure for password use and credit card transactions? You're assuming all kinds of facts not in evidence. My point was simply that the FireFox tradition (now enhanced) of warning about secure transfers to unverified sites was dumb: it creates a clear incentive for sites not to use HTTPS, so as not to scare their users.
ken 18y ago
First time I upgraded to FF3, I couldn't figure out the right combination of clicks to get to my (self-signed) site, and I just wanted to get some work done. So I gave up and used Safari instead. It's one thing to force users to confirm something whose security can't be guaranteed. It's another to make it so hard they stop using your app. FF3 has other nice security features I can't benefit from at all if I'm not using it. And StartSSL may be free, but it's not easier than "click the Safari icon".
deleted 18y ago
[deleted]

by pdubroy 18y ago

halo 18y ago

Doesn't change the fact that it pops up a scary unintelligible message and makes you jump through hoops whenever someone tries to visit a site with a self-signed certificate. It's very much a "break the web" situation. As suggested by the original article, the correct behaviour would be to treat it as though there's no security whatsoever. After all, logically, how is being encrypted but unauthenticated worse than being unencrypted and unauthenticated?

tptacek 18y ago
How can your browser tell the difference between: (1) A connection to onlinebanking.bankofamerica.com in which an attacker has hijacked the SSL handshake and subbed in a self-signed certificate, and (2) A connection to https://login.ratemykitten.com https://login.ratemykitten.com? You appear to be arguing that the warning for this situation should be tuned to (2).

ajross 18y ago

That's not the bug though. The bug is that the error message a user sees when visiting a self-signed site using HTTPS is much more scary than simply visiting that site on an unencrypted connection, even though by all reasonable standards this is a safer, more private, and more secure action. If we're not going to warn folks about unencrypted links where every proxy in the way is a man-in-the-middle attack waiting to happen, why are we going through such contortions to warn them about the same attacks in a situation where they are much harder to accomplish? I've never understood this warning at all.

sh1mmer 18y ago
This is because users are being trained to use sites "with the yellow bar at the top" to do personal things (e.g logging in, credit card details, etc). Making users have to jump through a couple hoops of hoops if the certificate is self-signed is a good way to protect users that don't understand the technology. While I understand you want to be very egalitarian about it most users would value their personal information's safety over the principle of a completely open web. In the spirit of the open web you are free to a) not use Firefox b) fork the Firefox project c) file a bug with Firefox d) contribute to Firefox and argue for this feature to be removed
- Herring 18y ago
  Yeah it's a branding issue. The yellow bar or the lock at the bottom should indicate a "secure" site. A self signed cert is no different from a fraudulent cert.
tptacek 18y ago
The warning says, "Here is a site that claims to be secure. Maybe you thought it was secure, maybe you didn't. Either way, the site is not secure. DO NOT ENTER YOUR PASSWORDS AND CREDIT CARD NUMBERS HERE." The warning is vibrant because the condition it reports on can be created by an attacker on any SSL connection. That stupid warning might be among the top five security mechanisms on the Internet.
- ajross 18y ago
  Why is a self-signed site insecure? Why isn't an HTTP site with a credit card prompt equally insecure (please, don't try to tell me that users look at the yellow bar -- we all know from direct experience that they don't)? Why is a properly certed site known to be secure for password use and credit card transactions? You're assuming all kinds of facts not in evidence. My point was simply that the FireFox tradition (now enhanced) of warning about secure transfers to unverified sites was dumb: it creates a clear incentive for sites not to use HTTPS, so as not to scare their users.

ken 18y ago

First time I upgraded to FF3, I couldn't figure out the right combination of clicks to get to my (self-signed) site, and I just wanted to get some work done. So I gave up and used Safari instead. It's one thing to force users to confirm something whose security can't be guaranteed. It's another to make it so hard they stop using your app. FF3 has other nice security features I can't benefit from at all if I'm not using it. And StartSSL may be free, but it's not easier than "click the Safari icon".

deleted 18y ago

[deleted]