Comments on: Welcome to SSLFail http://www.sslfail.com/2009/01/welcome-to-sslfail/ 1.2.840.113549.1.1 Thu, 01 Jul 2010 03:13:58 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: ToddH http://www.sslfail.com/2009/01/welcome-to-sslfail/comment-page-1/#comment-25 ToddH Sun, 25 Jan 2009 23:03:06 +0000 http://www.sslfail.com/?p=3#comment-25 I think SSL failures and the reliance on self-signed certs in many products is a great area to highlight. The recent browser warnings have served to bring it into focus where it was previously ignored by many. We spent a lot of time designing our product (and paying for thousands of genuine SSL certs) to avoid exactly this problem. My cofounder blogged about it last year at http://www.napera.com/blog/?p=52. An SSL certificate failure in our product is treated as a showstopper bug. I think SSL failures and the reliance on self-signed certs in many products is a great area to highlight. The recent browser warnings have served to bring it into focus where it was previously ignored by many.

We spent a lot of time designing our product (and paying for thousands of genuine SSL certs) to avoid exactly this problem. My cofounder blogged about it last year at http://www.napera.com/blog/?p=52. An SSL certificate failure in our product is treated as a showstopper bug.

]]> By: Cd-MaN http://www.sslfail.com/2009/01/welcome-to-sslfail/comment-page-1/#comment-23 Cd-MaN Thu, 22 Jan 2009 09:33:10 +0000 http://www.sslfail.com/?p=3#comment-23 Hello guys. Inspired by this site, I did a little research of my own: http://hype-free.blogspot.com/2009/01/sslfail.html The results are incredible (incredibly sad): less than 5% of the sites have proper certs. If you would like to get the final list or the script I used, let me know (it can keep this blog updated for years :-(). Hello guys.

Inspired by this site, I did a little research of my own: http://hype-free.blogspot.com/2009/01/sslfail.html

The results are incredible (incredibly sad): less than 5% of the sites have proper certs. If you would like to get the final list or the script I used, let me know (it can keep this blog updated for years :-( ).

]]> By: Marcin http://www.sslfail.com/2009/01/welcome-to-sslfail/comment-page-1/#comment-7 Marcin Tue, 13 Jan 2009 20:53:37 +0000 http://www.sslfail.com/?p=3#comment-7 Michael, You do know you can install your own CA into IE and Firefox before you rollout. This would prevent your users' browsers from popping up an error on internally hosted applications using SSL. Michael, You do know you can install your own CA into IE and Firefox before you rollout. This would prevent your users’ browsers from popping up an error on internally hosted applications using SSL.

]]> By: jgraver http://www.sslfail.com/2009/01/welcome-to-sslfail/comment-page-1/#comment-6 jgraver Tue, 13 Jan 2009 19:25:45 +0000 http://www.sslfail.com/?p=3#comment-6 Just wait until our posts on EV SSL Certs :-) If you find some great sites with non-SSL logins, send us the link. Just wait until our posts on EV SSL Certs :-)

If you find some great sites with non-SSL logins, send us the link.

]]> By: Michael Dickey http://www.sslfail.com/2009/01/welcome-to-sslfail/comment-page-1/#comment-2 Michael Dickey Tue, 13 Jan 2009 16:10:56 +0000 http://www.sslfail.com/?p=3#comment-2 Pre-comment question: Are you accepted screenshots of prominent sites whose logins are not SSL-protected? :) Ugh. The state of browsers right now has made screenshots of ssl failures so amazing. Every little discrepancy (or less money spent on 'normal' certs) results in error pages. It's pretty ridiculous. I can't wait to go to IE7/FF3 in my work environment (I use it, but it's not installed widely on users). I have about 40 internal-only web servers hosting roughly 300 different sites internally (mostly development copies of public sites). Every one is protected by a non-EV SSL internally-signed cert. Let alone almost all of my network devices... The band-aid of error alerts and green address bars to increase user awareness doesn't work, and was a stupid idea in the first place (way to make more money for CAs). It would be just a minorly stupid idea if it weren't so forced... :( Sorry, the state of SSL is a bit of a peeve of mine. I don't mind if a site like www.gmail.com uses the www.google.com SSL, but I do mind that browsers have moved away from pop-up warnings that can be turned off to obscure full-page warnings that make it sound like the site is evil and broken. Pre-comment question: Are you accepted screenshots of prominent sites whose logins are not SSL-protected? :)

Ugh. The state of browsers right now has made screenshots of ssl failures so amazing. Every little discrepancy (or less money spent on ‘normal’ certs) results in error pages. It’s pretty ridiculous.

I can’t wait to go to IE7/FF3 in my work environment (I use it, but it’s not installed widely on users). I have about 40 internal-only web servers hosting roughly 300 different sites internally (mostly development copies of public sites). Every one is protected by a non-EV SSL internally-signed cert. Let alone almost all of my network devices…

The band-aid of error alerts and green address bars to increase user awareness doesn’t work, and was a stupid idea in the first place (way to make more money for CAs). It would be just a minorly stupid idea if it weren’t so forced… :(

Sorry, the state of SSL is a bit of a peeve of mine. I don’t mind if a site like http://www.gmail.com uses the http://www.google.com SSL, but I do mind that browsers have moved away from pop-up warnings that can be turned off to obscure full-page warnings that make it sound like the site is evil and broken.

]]>