Re: for the security minded web developer - secure way to login?

OK, i hear about this self signed certificate. Whenever i signed anything it just came up with all these warnings in FF which confuses users and i think is not good at all. Can someone paste a link in here to a website with a self signed cert please? Would like to see if there are any warnings etc. Thanks. Tim Tim-Hinnerk Heuer http://www.ihostnz.com Jay London - "My father would take me to the playground, and put me on mood swings." 2009/2/15 Michael A. Peters <mpeters@mac.com> > Sudheer wrote: > >> Michael A. Peters wrote: >> >>> >>> Sites (like mine) that don't want to pay a certificate authority can use >>> a self-signed cert. Even Red Hat does for some of their stuff (IE I believe >>> their bugzilla server) >>> >>> Firefox scares its users when they encounter a website with self signed >> certificate. If your website users aren't worried about the warning Firefox >> throws at them, self signed cert works well. >> >> >> > Yeah it does, hopefully they fix it. > What scares me is allowing sites I have no reason to trust as non malicious > and have no reason to trust as properly secured against XSS injection to > load scripts that execute on my machine. > > People who use Firefox may be scared by the absurd warning FireFox 3 uses > (something I've complained about to them) - other than informing users of > the issue and hoping some read it, not much I can do about that. Hopefully > FireFox will fix the issue and do something like what opera does (except the > cert for session if you just click OK, accept it permanently if you click > the security tab and check a box first). > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > >