[Security] TLS Certificates Verification

Jonathan Schleifer js-xmpp-security at webkeks.org
Thu Aug 21 10:15:21 CDT 2008


Jonathan Dickinson <jonathanD at k2.com> wrote:

> Please tone it down Jonathan. Firstly this wizard is only run ONCE.
> Three of the steps are informational. Two of the steps are automatic.
> Two of the steps are skippable.

Ever heard about that "Wizards are never user friendly"? Well, it's
true. And I really hate to have wizard for something like crypto. Even
as an advanced user.

> That leaves, what, one step the user
> actually needs to complete? Firefox which has appraised on this list
> so much for its good security UI has about three windows to add a
> certificate exception.

It was praised because it makes it impossible for the average user to
allow an insecure certificate, which some consider it good. I, however,
consider it bad, because users with FF3 can't go to any site that uses
CACert.

> The GNOME  developers spend no end proclaiming that it has a good UI,
> and I agree. Are you just going to take the user through the whole
> process without first explaining what certificates are? Great UI.

I will not repeat again that I think certificates are wrong for the
average user, I already said this about 1000 times on this list.

> Are you not going to explain what good ideas to make sure they stay
> safe? Fantastic UI. I am sure aunt Tillie would happily just enter a
> password for the pfx, but lo be tide when she loses her key.

Maybe you should have a look at the Gajim UI, since I also did part of
that? That is what I'd call user friendly. Sure, it could be done
better, but it's ok for the moment. So you see, there is no need to
make it over complicated.

> Not to mention that once it's done, it would be _faster_ than your UI
> where users need to confirm session keys. One click on the toolbar
> 'encrypt session' done. You have two windows there, one saying here
> is your key, another saying are you sure you verified it.

Yeah, except that you need to trust a CA. Which do you trust, as even
the big ones got certs stolen etc?

> Go read up on the GNOME UI docs because they did a fantastic job.
> They literally consider EACH and EVERY button.

And they consider wizards bad, IIRC, yes…

> _Please_ can we move on from Gajim and ESessions. I am sure you are
> proud of your work, and you should be, but your way isn't the only
> way.

Brendan Taylor did ESessions for Gajim, not me.

-- 
Jonathan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: not available
Url : http://mail.jabber.org/pipermail/security/attachments/20080821/029b27da/attachment-0001.pgp 


More information about the Security mailing list