- From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
- Date: Mon, 09 Jul 2007 18:53:24 +0100
- To: Serge Egelman <egelman@cs.cmu.edu>
- Cc: michael.mccormick@wellsfargo.com, wdoyle@mitre.org, tlr@w3.org, public-wsc-wg@w3.org
Serge Egelman wrote: > > How is the risk that much greater for a self-signed certificate than a > standard CA-signed one? Since a certificate can be purchased for $20, a > self-signed cert is effectively as secure. Not really. I can scale an attack involving newly crafted SSCs as large as I like, but one that requires a $20 spend per different cert is more difficult. So "as secure" isn't strictly correct. > Now, what about expired > certificates? Can anyone really argue that an expired certificate is > riskier than a self-signed one? I wouldn't argue that. However, an expired cert is arguably riskier than a valid cert. (We're dealing with a partial order here at best.) > I would argue that most of the current > SSL-related warning messages have little impact on the user's security. > The only current browser error with regard to certificates that should > actually be meaningful is if a certificate has been revoked. How is "revoked" sensibly treated any different from "can't find certificate status information"? If it can't really be treated differently then there's a nice slippery slope that ends up presenting everything to do with PKI back to the user, which of course none of us want. So overall, I'd argue that no PKI stuff should be exposed at all, (modulo not knowing what I really think is best for SSCs;-) S.
Received on Monday, 9 July 2007 17:51:39 UTC