Re: Link-fingerprints: weak unless link received securely

2007-06-23 Thread David E. Ross
On 6/23/2007 2:31 PM, Nelson B wrote: > Gerv, Your web page http://www.gerv.net/security/link-fingerprints/ > doesn't provide any obvious channel for feedback or public discussion > of that proposal, that I can see. So, I'm using this channel. > > The page makes certain claims that I don't belie

Re: nss and mozilla database

2007-06-23 Thread Nelson B
[EMAIL PROTECTED] wrote: > When I created the cert, I got a x509.cacert which I read ( > http://web.archive.org/web/20060425194511/www.mozdevgroup.com/docs/pete/Signing-an-XPI.html > ) was used to sign objects. I think this is incorrect, and is the > public key, not a private key. Several

Re: nss and mozilla database

2007-06-23 Thread Nelson B
Kaspar Brand wrote: > How exactly did you create (and sign) the request for [EMAIL PROTECTED] By > "validating", do you mean using "certutil -V"? If so, the problem might > be the correct certusage ("-u" switch) - you should actually specify > object signing, but it seems that certutil will only a

Link-fingerprints: weak unless link received securely

2007-06-23 Thread Nelson B
Gerv, Your web page http://www.gerv.net/security/link-fingerprints/ doesn't provide any obvious channel for feedback or public discussion of that proposal, that I can see. So, I'm using this channel. The page makes certain claims that I don't believe. Here's one. > To substitute a trojan, the

Re: Why only 4 certificates on the list?

2007-06-23 Thread Nelson B
[EMAIL PROTECTED] wrote: > I don't know why there are only 4 certificates on the user certificate > list when I use window.crypto.signText. I have 5 certificates > installed in my Firefox and I can see all of them from the Tools --> > Options --> See certificates but, when the certificate's selecti