Re: Moving browser PKI forward (Re: Problem reading certificate from hardware token)

2009-07-05 Thread Martin Paljak
On 05.07.2009, at 0:11, Nelson B Bolyard wrote: FYI, to make sense to users of eID cards currently one has to embed the word PIN into the token description as well, so that the prompt that Firefox displays would make sense: Please enter password for: MARTIN PALJAK (PIN1) GUI hints would be

Re: Moving browser PKI forward (Re: W3C Terminates XHTML2)

2009-07-05 Thread Anders Rundgren
William L. Hartzell wrote: snip I assume that you been following IETF RFC on the Crypto subject. They just released a series of RFC on management of keys. I have not heard of this before unless you are talking about TAM, TAMP or KEYPROV. None of these efforts have any relevance for the subject

Re: Moving browser PKI forward (Re: Problem reading certificate fromhardware token)

2009-07-05 Thread Anders Rundgren
Nelson Bolyard wrote: Yes, telling the user who wants it would help A LOT. Sadly, that's a browser architecture matter of which the NSS team has no influence. Martin Paljak wrote: I think that approaching Firefox team from the NSS side AND from outside would give a better result than just

Re: Moving browser PKI forward (Re: Problem reading certificate from hardware token)

2009-07-05 Thread Nelson B Bolyard
On 2009-07-05 05:57 PDT, Martin Paljak wrote: The problem is that an average users thinks like this: password is something like 'topsecret123', PIN code is something like '1234', I'm asked for a password, let me see, which passwords I know that I might type here... More experienced

Re: Problem reading certificate from hardware token

2009-07-05 Thread Nelson B Bolyard
On 2009-07-04 04:31 PDT, Eddy Nigg wrote: On 07/04/2009 02:20 PM, Anders Rundgren: It's not a good idea to place the CA certificate on the token because I think it is Firefox that's confusing. Sure, it's a bug. If the CA root is trusted in the software security device, its trust bits

Re: Problem reading certificate from hardware token

2009-07-05 Thread Eddy Nigg
On 07/06/2009 01:44 AM, Nelson B Bolyard: Sure, it's a bug. If the CA root is trusted in the software security device, its trust bits should not be overridden by the same CA certificate on the tokenbut alas... Is there a bug on file with a reproducible test case? Yup

Re: Moving browser PKI forward (Re: Problem reading certificate from hardware token)

2009-07-05 Thread Ian G
On 4/7/09 23:19, Nelson B Bolyard wrote: On 2009-07-04 04:19 PDT, Ian G wrote: Some remarks. On 4/7/09 12:18, Martin Paljak wrote: Firefox displays a Please enter password for ... dialog, which is ambiguous for casual users who need to be said very clearly when they need to enter the PIN of

Re: Moving browser PKI forward (Re: W3C Terminates XHTML2)

2009-07-05 Thread William L. Hartzell
Anders Rundgren wrote: Snip There is also no natural home for these issues since Mozilla, Apple, Google and Microsoft haven't heard about such requirements which is due to the fact that two-factor-authentication on the US consumer market is close to zero. In fact, in the Information Card forum

SSL module for nginx implemented using NSS

2009-07-05 Thread Peter Djalaliev
Hello, Does anybody know if there is an SSL/TLS module for nginx implemented using NSS? The module that ships with nginx uses OpenSSL. I didn't find anything on Google. Best Regards, Peter Djalaliev -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org