Re: SSL makes me crazy (was Re: How to run Microsoft Internet Explorer on NetBSD?)

[Hal Murray <hmurray%megapathdsl.net@localhost>]

swiftgriggs%gmail.com@localhost said:
> Well, the way I understand it, (and I'm probably wrong) but a
> man-in-the-middle would have to be able to break Diffie Hellman

How did you get your banks public key?  Without a chain-of-trust you have to get it on your own and the man in the middle has a good chance of subverting that process.

You aren't the only one who dislikes the current system, but nobody has come up with a better plan.  Yet.


> When it comes down to brass-tacks, do you trust Verisign is doing what they
> say they do to verify that the cert holder is the party  you want to have an
> encrypted conversation with ?

Verisign has serious incentives to do the right thing.  If they screwup they are likely to go out of business.  The NSA may be able to twist their arm, but Verizon or Comcast probably can't.

I think the major certificate issuing companies have various degrees of checking.  I don't know the details.  Checking costs money.  I think some of the options are serious enough to be appropriate for banks.

If I was going to put serious effort into this area, I'd look into a UI to display the chain so I could get convenient reminders about who was signing things I used.  Maybe a nightly summary.  Maybe a confirm step if the top level signer was strange where I get to maintain a white-list of sites that are non-strange for me.


-- 
These are my opinions.  I hate spam.