Mozilla Debates Whether To Trust Chinese CA 276
At his Freedom to Tinker blog, Ed Felten has a thoughtful, accessible piece on the debate at Mozilla about whether Firefox, by default, should trust a Chinese certificate authority (as it has since October). Felten explains in clear language why this is significant, and therefore controversial. An excerpt: "To see why this is worrisome, let's suppose, just for the sake of argument, that CNNIC were a puppet of the Chinese government. Then CNNIC's status as a trusted CA would give it the technical power to let the Chinese government spy on its citizens' 'secure' web connections. If a Chinese citizen tried to make a secure connection to Gmail, their connection could be directed to an impostor Gmail site run by the Chinese government, and CNNIC could give the impostor a cert saying that the government impostor was the real Gmail site."
Re:Configuration Option (Score:4, Funny)
All you have to do is click your heels together three times, and repeat after me.
There's no place like Options / Advanced / Encryption / View Certificates / Authorities / (use mouse to select all) / DELETE. ...
There's no place like Options / Advanced / Encryption / View Certificates / Authorities / (use mouse to select all) / DELETE.
There's no place like Options / Advanced / Encryption / View Certificates / Authorities / (use mouse to select all) / DELETE.
Re:Well in that case (Score:0, Funny)
OK, here it is:
World news for the last 30 years. Go ahead, google it. I'll wait while you catch up...
Re:It's OSS (Score:5, Funny)
Oh they do, they just don't appear on your browser because China MITM'ed your http session and changed the website.