Re: Rant on HTTPS everywhere

On 2015 Jan 8, at 01:04 , Rob Meijer <rmeijer-qWit8jRvyhVmR6Xm/[email protected]> wrote:

> http://minorfs.wordpress.com/2015/01/07/why-https-everywhere-is-a-horrible-idea-for-now/
typos:
"bit of a background"/"big of a background"
"effortlessly"/"effordlesly"

Agreed: When I hear a crypto protocol has suite options, I ask "Whose option is it?".

As it is I have just two institutions which which I want trusted communications.
One is a bank.
I have marked most of the CA's as untrusted in Apple's Keychain Access utility.
Also "belt and suspenders" I visually recognize my banks public key fingerprint.

Some browsers allow you click thru on failing https certs (Chrome)
Others try and fail (Safari).
Some browsers maintain their own CA list and ignore Apple's (Firefox)
Firefox on my machine trusts most CAs; I don't do banking with Firefox.
Some sites send pages over https that include https links to ccs files at different sites and different certs.
No browser I know knows how to negotiate with the user concerning these secondary certs.
Firefox shows me those pages because it trusts most CA's.

I use three browsers and manage to get the stuff I want.

Ouch.