Convergence.
nobody <[email protected]> Tue, 15 Apr 2014 16:43:09 +0200
| Newsgroups | gmane.comp.mozilla.devel.plugins,gmane.comp.mozilla.security,gmane.comp.mozilla.devel.security.policy,gmane.comp.mozilla.wishlist |
|---|---|
| Message-ID | <CAMKnNXmXoA0S=xX4sTaXBbVST7HJYprJuB_mRpO_cf66uWJrOg@mail.gmail.com> |
Hello,
After I watched Moxies talk about Convergence for the second time in my
life:
https://www.youtube.com/watch?v=Z7Wl2FW2TcA
http://convergence.io/details.html
I just wondered... what is the pull back regarding Convergence to put it in
the webbrowsers by default?
Problems regarding Convergence from Slashdot:
So I hijack the router that website is using to access the internet. I
install some software on the
router to return a fake cert. I see the fake cert. All of the other
notaries see the fake cert. It this
is popular site the notaries might notice a cert change, but if its a
low volume site that the notaries
never go to. We all agree the fake cert is valid. How is this more
secure? Or I hack the router you
use to access the internet... all of the notaries you try to talk to I
redirect to me. I say every site is
valid regardless if it is or not. How is this more secure?
-->>
Presumably because the CA would be running its own notary (or notary
check), and thus is able to detect certificate variations?
Any thoughts, opinions about the topic?
Why couldn't Firefox have Convergence built-in to free us from the CA
system?
It's a very sad thing that Convergence isn't maintained nowadays...
Have a nice day.