mizerydearia (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 15, 2010, 04:26:20 PM Last edit: September 15, 2010, 04:48:24 PM by mizerydearia |
|
From here discuss SSL certificates from various authorities. Do it! NAO! you fail
|
|
|
|
The Madhatter
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 15, 2010, 04:35:21 PM |
|
I think that the whole browser CA trust thing is horribly flawed. It should follow the SSH-like model. The browser should cache all new certs silently and only alert the user if the cert has been changed.
You can get FF to do this by mucking with the preferences and a plugin called "Certificate Patrol".
|
|
|
|
theymos
Administrator
Legendary
Offline
Activity: 5306
Merit: 13287
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 15, 2010, 05:15:23 PM |
|
I don't trust CACert's security, so I don't allow them to hijack all of my TLS connections (which adding them as a CA does). I've removed a few dozen built-in certs in Firefox because I don't trust those companies (GoDaddy is a commonly-used one that I've removed). There's no harm in MyBitcoin using CACert, though, since I can just treat their specific cert as self-signed and allow it. StartSSL would probably be better, since it's accepted in most browsers. You can get FF to do this by mucking with the preferences and a plugin called "Certificate Patrol". Certificate Patrol only monitors certificates that have already been accepted by the browser. Firefox's handling of untrusted certificates is poor -- I frequently get vague errors about untrusted certs (with no information about which cert is causing the trouble), and it's impossible to autoupdate if you don't trust certain CAs.
|
1NXYoJ5xU91Jp83XfVMHwwTUyZFK64BoAD
|
|
|
Gavin Andresen
Legendary
Offline
Activity: 1652
Merit: 2300
Chief Scientist
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 15, 2010, 05:20:59 PM |
|
Picking up from the original thread...
Bitcoin-related sites that have self-signed or CACert certificates (like mybitcoin.com) look unprofessional and un-trustworthy to clueless non-techies.
I know, I know, a Verisign-certified certificate isn't really any guarantee of security, but that doesn't matter-- if you want ordinary users to start trusting your website, get a certificate that doesn't popup any scary-looking security warnings.
|
How often do you get the chance to work on a potentially world-changing project?
|
|
|
The Madhatter
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 15, 2010, 05:28:52 PM |
|
One thing that I have noticed from a lot of experience in selling online is that security warnings (browser cert popups) around dealing with money should be avoided. It scares the 'average joe' away from making a purchase, or it makes the whole experience seem 'shady'. The mainstream media has done an excellent job with internet fear mongering.
I don't have any problems, personally, with mybitcoin's choice in a cacert certificate. I just whitelist the fingerprint with my FF plugins.
However, if their intentions are to run a shopping cart interface facility they should really rethink their decision. The adoption of Bitcoin is key.
|
|
|
|
The Madhatter
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 15, 2010, 05:33:47 PM |
|
Looks like you posted something similar, gavinanderson. ![Tongue](https://bitcointalk.org/Smileys/default/tongue.gif) I didn't see your post until I hit "post" over here. Ah well. Anyway, we are all preaching to the choir. We already know all of the pros and cons around CAs and self-signed certs. I just got an email back from mybitcoin. Tom told me that getting a new cert was on the todo list. He told me that it was planned before the payment pages went live. P.S. Pecunix has been using self-signed certs for quite a while now. I wonder if that has impacted their sales. Food for thought.
|
|
|
|
The Madhatter
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 15, 2010, 05:48:57 PM |
|
I removed all of the CA trust from my FF, installed cert patrol (and a few others), and I don't autoupdate. My updates are applied manually. Call me paranoid. ![Tongue](https://bitcointalk.org/Smileys/default/tongue.gif) Certificate Patrol only monitors certificates that have already been accepted by the browser. Firefox's handling of untrusted certificates is poor -- I frequently get vague errors about untrusted certs (with no information about which cert is causing the trouble), and it's impossible to autoupdate if you don't trust certain CAs.
|
|
|
|
Anonymous
Guest
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 16, 2010, 01:18:23 AM |
|
It seems unfair that there is no open source certification authority available and that the mozilla foundation is pushing people into using one particular version from a private company. That seems awfully close to what ebay does with paypal. Someone should investigate how much verisign donates to the mozilla foundation and if there is any correlation. From Verisign Total: 1,275AUD (excluding taxes)
Damn that's for 1 year! ![Shocked](https://bitcointalk.org/Smileys/default/shocked.gif)
|
|
|
|
chaord
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 16, 2010, 01:55:27 AM |
|
To be honest, I'm kind of surprised that there isn't some open source, trusted certificate authority. Yet, when I started searching around this really does seem to be a missing piece of the puzzle. Is it possible to build an opensource, decentralized certificate authority? Or is that an oxymoron?
|
|
|
|
Anonymous
Guest
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 16, 2010, 03:12:44 AM |
|
To be honest, I'm kind of surprised that there isn't some open source, trusted certificate authority. Yet, when I started searching around this really does seem to be a missing piece of the puzzle. Is it possible to build an opensource, decentralized certificate authority? Or is that an oxymoron?
Bitcoin?lol
|
|
|
|
theymos
Administrator
Legendary
Offline
Activity: 5306
Merit: 13287
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 16, 2010, 01:11:15 PM |
|
Once DNSSEC is working, it'll be possible to securely put your cert's fingerprint in DNS. Then only people you're actually doing business with -- ICANN, the TLD registry, and your registrar -- will be able to compromise your site's encryption (at great risk to future trust from customers). Right now an attacker needs to control only one of several hundred root CAs (plus an unknown number of sub-CAs), but with DNS-based authentication, they'd be pretty much limited to the registrar (ICANN and the registry aren't likely to give in easily).
|
1NXYoJ5xU91Jp83XfVMHwwTUyZFK64BoAD
|
|
|
The Madhatter
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 16, 2010, 06:30:34 PM |
|
Looks like mybitcoin's cert changed this morning...
|
|
|
|
eurekafag
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 26, 2010, 02:55:13 PM |
|
Everybody can get SSL certificate for 2nd level domain and 1 subdomain for free here: https://www.startssl.com/?app=12 (press Express Lane button). Works for one year at least, then it should be updated. Recognized by all browsers. But it gives only the encryption and domain matching, no personal checks are done at all. I think it's pretty enough for our purposes (protect people from eavesdropping).
|
|
|
|
eurekafag
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 27, 2010, 05:19:27 AM |
|
Yes, haven't noticed that.
|
|
|
|
|