Xplo Eristotle wrote:
> As a user who's technically-competent in general, but has little-to-no
> knowledge about the kind of security you're trying to achieve here,
> allow me to make some points. Consider this "user feedback", by all means.
Xplo,
please understand that PKI (and probably trust in general) *is*
inherently a complicated world. You have to spend at least an hour or
two to understand what this is all about. At least, if you want to use
it extensively. The is no different from the need to understand the
basics of the Internet and the Web, if you want to use a browser. Or to
understand the basics of computers and your OS, if you want to use any
app at all.
1. If you just want to check <http://www.cnn.com>, you don't need to
care at all, because PSM wouldn't be used at all.
2. If you just want to transfer your credit card number to a web shop
without anybody listening, you have to understand only a fraction
of PSM and its UI.
3. If you want to sign your mail / trust signatures of mail and use
smart cards, you have to invest some time to learn.
It might be that the PSM UI is overly complicated (I don't know), but
you are basically asking "huh? What is an URL?" (if you compare that to
browsers).
> Bob Lord wrote:
>
>> Almost all of them are present in
>> Communicator and IE.
>
> I use Communicator. I don't remember all that stuff.
Because you never used it?
>> I'm not sure what you mean by the Security Manager. Do you mean the
>> Certificate Manager?
>
> The what?
>
> I've only seen a certificate used once in all my time on the web.. and
> that was for something stupid. (Downloading a piece of software, IIRC.)
> I have yet to understand what use these are to anybody, or why they're
> apparently given out free to everyone who downloads a browser; what good
> is a lock if everyone has the key?
I'm sorry, but this shows that you are lacking even enough knowledge for
the 2. task above.
in short: A certificate is something like a digital ID card. It is used
each time you use SSL to authenticate the website. Without the cert,
https just wouldn't work. It allows you (and the browser) to see the
originator of the data (according to the CA).
>> Does that mean that you cannot get
>> or view your personal certs with Mac IE, can't see CA certs, for
>> example?
>
> Huh?
If you ever sent a signed mail, you know what a cert and a CA is.
>> The Device Manager is the way you manage and troubleshoot your smart
>> cards...
>
> Huh?
Smart cards. You know, the little devices that look like a credit card
(actually, many current bank cards here *are* smart cards in the broad
sense) and that store your certs.
>> When things are working correctly with
>> your smart card, you don't need to go here. If things are not working
>> correctly, however, you'll need to a way to see which modules are
>> loaded, and which tokens are present.
>
> What on earth are you talking about?
Are are unfair here. If you never used a smart card, you are not
supposed to understand that.
>> It's possible that the hardware drivers are not loaded correctly.
>
> Hardware drivers? For what?
For the devices where you insert the smart card? Or the smart card itself?
> Mozilla is a piece of software, not a
> peripheral. Why does it need hardware drivers?
Windows is also a piece of software, nevertheless it has a Device
Manager and hardware drivers.
> Shouldn't the OS be handling all of that?
What, if the OS doesn't?
Mozilla manages hardware in the same sense as scanning or modem software
does.
> Greek to me, pal. I don't know who these people are who use this stuff,
> but it sure as hell isn't me, and it isn't anyone I know.
Obviously. Why are you commenting here then?
>> You might want to turn off TLS if you encounter a web site that is
>> "TLS intolerant".
>
> I have some idea what SSL is, but WTF is TLS?
The successor of SSL. (No idea, why the name has changed.)
> How would I know if a site
> is "TLS intolerant", anyway?
>
>> Users choose weak passwords. But unless they get feedback on what's
>> "worse" and what's "better", they're not going to improve the quality of
>> their passwords.
>
> Finally, something in English. But this is silly; anyone who'd be
> messing with this much security stuff in the first place surely knows
> what kind of passwords to choose.
No. Unfortunately no.
Weak passwords are one of the largest security problems overall. I think
that a "password quality meter" is a *very* good idea.
> What? People don't read documentation? Well, surely that's their
> problem. RTFM, yes?
No, with weak passwords, it's usually not only their problem. If a
password is broken, an attacker might get access to sensitive data or
resources. And these data and resources are usually *shared*, like
private emails (there always also a sender), company secrets etc..
>> You might also
>> want to turn off the low-grade encryption ciphers to make sure you're
>> only using the high-grade crypto.
>
> Shouldn't the high-grade crypto stuff be on by default, and transparent
> to the user?
It is. But you missed the "only"! If low-grade ciphers are enabled,
things might be *too* transparent - the transaction might use relatively
weak crypto while the user assumes strong crypto. If low-grade ciphers
are disabled, you might not be able to communicate with some servers
(which only support that relatively weak crypto).
