Confirmed users, Administrators
5,526
edits
CA:MaintenanceAndEnforcement: Difference between revisions
Jump to navigation
Jump to search
m
→Concerns
m (→Concerns) |
m (→Concerns) |
||
| Line 142: | Line 142: | ||
* If the certificate to be Actively Distrusted is used by a large portion of the internet population, immediately distrusting the certificate could make many high-traffic websites no longer be reachable, giving the appearance of a large network outage, or users might take actions (such as permanently trusting the bad cert) to bypass error messages. | * If the certificate to be Actively Distrusted is used by a large portion of the internet population, immediately distrusting the certificate could make many high-traffic websites no longer be reachable, giving the appearance of a large network outage, or users might take actions (such as permanently trusting the bad cert) to bypass error messages. | ||
** Possible Scenario: A root certificate that is chained to by many high-traffic websites is compromised and has to be Actively Distrusted. This is done and an update to Firefox pushed out. Then a large number of users can no longer browse to the high-traffic websites, giving the appearance of an outage, costing those high-traffic websites loss in money, causing frustration and confusion to end users who are regular customers of those websites. Many end-users are likely to manually-override the error, permanently trusting the certificate. Then if they later accidentally browse one of the corresponding malicious websites, they will not get an error. | ** Possible Scenario: A root certificate that is chained to by many high-traffic websites is compromised and has to be Actively Distrusted. This is done and an update to Firefox pushed out. Then a large number of users can no longer browse to the high-traffic websites, giving the appearance of an outage, costing those high-traffic websites loss in money, causing frustration and confusion to end users who are regular customers of those websites. Many end-users are likely to manually-override the error, permanently trusting the certificate. Then if they later accidentally browse one of the corresponding malicious websites, they will not get an error. | ||
** Possible | ** Possible Solutions: {{Bug|712615}}, {{Bug|643982}}, or make an announcement that the root will be distrusted on such a date, allowing a small transition time for websites to update their SSL certs before before the Firefox chemspill update is released. | ||
* The Certificate Manager does not recognize the "distrust" flag, so there is no distinction in the user interface between Actively Distrusted certificates and all other certificates. Additionally, users can manually turn on the trust bits for Actively Distrusted certificates. | * The Certificate Manager does not recognize the "distrust" flag, so there is no distinction in the user interface between Actively Distrusted certificates and all other certificates. Additionally, users can manually turn on the trust bits for Actively Distrusted certificates. | ||
** Possible Scenario: A user gets an error message that a website they browsed to is untrusted. They open the Certificate Manager and turn on the trust bits for an Actively Distrusted cert. This change is permanent until the user manually restores the default root settings or turns off the trust bits for that cert. So at some later date the user could accidentally browse to the corresponding malicious website and the site will appear to be trusted. | ** Possible Scenario: A user gets an error message that a website they browsed to is untrusted. They open the Certificate Manager and turn on the trust bits for an Actively Distrusted cert. This change is permanent until the user manually restores the default root settings or turns off the trust bits for that cert. So at some later date the user could accidentally browse to the corresponding malicious website and the site will appear to be trusted. | ||