<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 01/23/2013 08:37 AM, Tanstaafl
wrote:<br>
</div>
<blockquote cite="mid:50FFE786.7020401@libertytrek.org" type="cite">While
I understand the reasoning, I'm *very* interested in your response
to ace's last reply about how the use of the Certificate Patrol
extension combined with a properly installed self-signed cert is
actually more secure than using a trusted cert issued by a CA
(without the Cert Patrol extension installed)...
<br>
</blockquote>
<br>
I agree with Ace's statement, although I would probably qualify that
with the statement that you really want to manually verify the hash
of the key when first accepting it.<br>
<br>
<br>
<blockquote cite="mid:50FFE786.7020401@libertytrek.org" type="cite">Also,
it sounds like, in your last comment about 'certificate pinning',
that you are describing a similar but less functional method for
dealing with changed certs than Cert Patrol uses... so, why not
just incorporate its functionality instead of reinventing the
wheel?
<br>
</blockquote>
<br>
If the code is Apache 2.0 licensed/compatible or the authors are
willing to re-license, whatever code is reusable seems like a good
thing to reuse. Judging from the AMO comments, it seems like the
extension may have problems with server farms where not all machines
use the same certificate, so it might not be a slam dunk and new
code might need to be written to try and generalize the certificate
to a specific CA-chain before alerting, etc.<br>
<br>
Another interesting Firefox certificate extension is convergence:
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<a href="http://www.convergence.io/index.html">http://www.convergence.io/index.html</a><br>
<br>
Andrew<br>
</body>
</html>