Re: Re: for the security minded web developer - secure way to login?
| From: | Per Jessen | Date: | Mon, 16 Feb 2009 13:49:25 +0000 |
| Subject: | Re: Re: for the security minded web developer - secure way to login? | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-288325@lists.php.net to get a copy of this message | ||
Colin Guthrie wrote:
> Yeah the cheap CA's are IMO actually a problem.
>
> I (personally) think we should have a new system for this scenario:
>
> http:// = totally insecure
> https:// = secure and to a reasonable degree of trust (e.g. no
> $12.00
> certs!)
> httpus:// = secure but no aspect of trust.
Colin, I think you're mixing apples and oranges here - http(s) was never
meant to provide any indication of "trust". Besides, how do you suggest
we distinguish between CAs "with no trust" and CAs "with trust"?
/Per
--
Per Jessen, Zürich (1.1°C)