Firefox 3 Improves Handling of Invalid SSL Certificates - The Community's Center for Security


The central voice for Linux and Open Source security news

Welcome!

Sign up!

EnGarde Community

Polls

How strictly do your users obey your security policies?

	To the letter.
	For the most part.
	When it suits them.
	By chance.
	Not at all.

Advisories

Community

Linux Events

Linux User Groups

Link to Us

Security Center

Book Reviews

Security Dictionary

Security Tips

SELinux

White Papers

Featured Blogs

Emily Ratliff: OS Security

DanWalsh LiveJournal

Security Bloggers Network

Latest Newsletters

Linux Security Week: December 1st, 2008

Linux Advisory Watch: November 28th, 2008

LinuxSecurity Newsletters

RSS Feeds

Get the LinuxSecurity news you want faster with RSS

Firefox 3 Improves Handling of Invalid SSL Certificates

User Rating:

How can I rate this item?

Source: tuxmachines - Posted by Bill Keys

I have downloaded the beta of Firefox 3 to check out the improvements related to SSL. First, there's the added support for Extended Validation SSL certificates, but I am not very excited about that (I wrote about this previously in Extended Validation SSL certificates not going anywhere, as predicted). It's a nice feature, but it's not going to bring much good overall. On the other hand, I am very happy with the improvements to the handling of invalid SSL certificates. A much needed improvement to handling invalid SSL certificates were added to Firefox 3. What do you think about the improvements.

Read this full article at tuxmachines

Comments

good stuff

Written by pierce on 2008-05-02 20:26:32

Now they need to fix this for thunderbird :-) I am so used to the new warning system that I came very close to clicking through a cert warning at a coffee shop the other day. I was able to fix my route and find/beatup the kid running cain, but imagine how many people get hit by that every day without even noticing.

I still don't like how they allow users to submit postdata from password forms without requiring SSL (or even throwing up any sort of warning). Is anyone doing much to prevent these kinds of downgrade attacks? I heard something about a firefox plugin in the works a while back, but I don't think it got anywhere.

ya	Written by jon on 2008-05-05 08:15:33

Yeah a much needed fix

Write Comment
Please keep the topic of messages relevant to the subject of the article. Personal verbal attacks will be deleted. Please don't use comments to plug your web site.. Such material will be removed.
Name:
Title:
Comment:
Code:*

< Prev		Next >

Partner:

Latest Features

A Secure Nagios Server

Never Installed a Firewall on Ubuntu? Try Firestarter

Review: Hacking Exposed Linux, Third Edition

Security Features of Firefox 3.0

Review: The Book of Wireless

April 2008 Open Source Tool of the Month: sudo

Open Source Tool of March: ZoneMinder

Yesterday's Edition

Linux Role in Botnets Studied

10 Mistakes New Linux Administrators Make

QuickLinks: Comunity , HOWTOs , Blogs , Features , Book Reviews , Networking ,
Security Projects , Latest News , Newsletters , SELinux , Privacy , Home,
Hardening , About Us, Advertise, Legal Notice, RSS, Guardian Digital