Firefox 3 Improves Handling of Invalid SSL Certificates - The Community's Center for Security


The central voice for Linux and Open Source security news

Welcome!

Sign up!

EnGarde Community

Polls

What is the most important Linux security technology?

	SELinux
	grsecurity
	CIS Benchmark
	Bastille Linux
	iptables
	LIDS

Advisories

Community

Linux Events

Linux User Groups

Link to Us

Security Center

Book Reviews

Security Dictionary

Security Tips

SELinux

White Papers

Featured Blogs

All About Linux

DanWalsh LiveJournal

Securitydistro

Latest Newsletters

Linux Security Week: February 6th, 2012

Linux Advisory Watch: February 3rd, 2012

LinuxSecurity Newsletters

RSS Feeds

Get the LinuxSecurity news you want faster with RSS

Firefox 3 Improves Handling of Invalid SSL Certificates

User Rating:

How can I rate this item?

Source: tuxmachines - Posted by Bill Keys

I have downloaded the beta of Firefox 3 to check out the improvements related to SSL. First, there's the added support for Extended Validation SSL certificates, but I am not very excited about that (I wrote about this previously in Extended Validation SSL certificates not going anywhere, as predicted). It's a nice feature, but it's not going to bring much good overall. On the other hand, I am very happy with the improvements to the handling of invalid SSL certificates. A much needed improvement to handling invalid SSL certificates were added to Firefox 3. What do you think about the improvements.

Read this full article at tuxmachines

Comments

good stuff

Written by pierce on 2008-05-02 20:26:32

Now they need to fix this for thunderbird :-) I am so used to the new warning system that I came very close to clicking through a cert warning at a coffee shop the other day. I was able to fix my route and find/beatup the kid running cain, but imagine how many people get hit by that every day without even noticing.

I still don't like how they allow users to submit postdata from password forms without requiring SSL (or even throwing up any sort of warning). Is anyone doing much to prevent these kinds of downgrade attacks? I heard something about a firefox plugin in the works a while back, but I don't think it got anywhere.