Subject: Re: Microsoft deems all DigiNotar certificates untrustworthy, releases Date: Mon, Sep 12, 2011 at 10:42:35PM +0200 Quoting fredrik danerklint (fredan-nanog@fredan.se):
Quite trivial, in fact.
and how about a end user, who doesn't understand a computer at all, to be able verify the signatures, correctly?
Joe Sixpack clicks through today. He will, too, later, but, one of the Fine Things with DANE is that no entity can produce valid data for anything outside its own domain(s). Damage limitation is quite important, while admittingly not being the silver bullet. The existence of a free and secure chain of trust will put a price pressure on DV certificates, which just might create a situation where the marginal cost for doing TLS is so low that it is hard to set up a web site without. Taken together, this creates a situation where valid, verified certificates are the norm, for real, which makes it all the more possible to flag the exceptions much more annoyingly. Perhaps even refuse to open them. -- Måns Nilsson primary/secondary/besserwisser/machina MN-1334-RIPE +46 705 989668 ... this must be what it's like to be a COLLEGE GRADUATE!!