Chris Blankenship's Ramblings

Recently I stumbled across a web page from a Firefox engineer that talked about how Firefox 3 handles Self-Signed Certificates.  The article was lengthy and includes several links to people who are both pro and con towards using self-signed certificates.  It seems everyone has an opinion on this matter, so much in fact that it’s almost become a religious discussion.

Firefox’s position is that self-signed certificates are bad:

Before we begin, we must understand that Security = Encryption * Authentication. World-class encryption * zero authentication = zero security. This is an absolutely crucial point which sadly is not grasped by many participants in the debate. There’s no point in encrypting your data with a secret key if you don’t know whose key it is and who you are sending it to.

My first reaction to this quote is to bang away on my keyboard about why I disagree.  But then I remembered that it’s a religious discussion and the other party doesn’t really care what I have to say; their mind is made up.

What I can say is that I am firmly in the opposite camp than Firefox.  Go ahead, use a self signed certificate if all you care about is protecting the data in transport.  It doesn’t bother me much that my opinion is different than Firefox, but their browser behavior truly does bother me.  Whenever I come across an un-trusted certificate I get frustrated at all of the steps that I have to take to get around the connection warnings.

Time will tell if the general public will tolerate the excessive warnings and the absolute inability to disable the warnings.  I’m actually a little surprised that Firefox doesn’t mandate that my browser opens up to their update page each time.  After all, wouldn’t that help protect the user by forcing them to see all the daily updates that come out for Firefox?