Re: Moving browser PKI forward (Re: W3C Terminates XHTML2)

2009-07-04 Thread William L. Hartzell
Sir: Anders Rundgren wrote: Nelson B Bolyard Wrote. This demonstrates that standardization is an option but an increasingly difficult option as well in an ever faster-moving world: http://www.w3.org/2009/06/xhtml-faq.html Does it? It appears to me that this is the standards body pruning th

Re: Moving browser PKI forward (Re: Problem reading certificate from hardware token)

2009-07-04 Thread Nelson B Bolyard
On 2009-07-04 04:19 PDT, Ian G wrote: > Some remarks. > > On 4/7/09 12:18, Martin Paljak wrote: > >> Firefox displays a "Please enter password for ..." dialog, which is >> ambiguous for casual users who need to be said very clearly when they >> need to enter the PIN of 4 or more digits. Right now

Re: Moving browser PKI forward (Re: Problem reading certificate from hardware token)

2009-07-04 Thread Nelson B Bolyard
Martin, I want to read your full message and respond fully later this weekend, but right now I just want to try to clarify a couple things. >>> FYI, to make sense to users of eID cards currently one has to embed >>> the word PIN into the token description as well, so that the prompt >>> that Firef

Re: Problem reading certificate from hardware token

2009-07-04 Thread Eddy Nigg
On 07/04/2009 02:31 PM, Eddy Nigg: I've been begging for this feature to be implement, to no avail... s/implement/implemented/ As such it's amazing to hear the arguments against doing so, specially when some 70% of the browser market does that successfully with no drawback or breach of priv

Re: Problem reading certificate from hardware token

2009-07-04 Thread Eddy Nigg
On 07/04/2009 02:20 PM, Anders Rundgren:It's not a good idea to place the CA certificate on the token because I think it is Firefox that's confusing. Sure, it's a bug. If the CA root is trusted in the "software security device", its trust bits should not be overridden by the same CA certi

Re: Problem reading certificate from hardware token

2009-07-04 Thread Anders Rundgren
Eddy Nigg wrote: >> Actually, I haven't seen evidence of that, although you did claim that when >> you imported the PKCS#12 file into the software token, that the missing CA >> cert was then found present. >It's not a good idea to place the CA certificate on the token because >the trust bits may

Re: Moving browser PKI forward (Re: Problem reading certificate from hardware token)

2009-07-04 Thread Ian G
Some remarks. On 4/7/09 12:18, Martin Paljak wrote: Firefox displays a "Please enter password for ..." dialog, which is ambiguous for casual users who need to be said very clearly when they need to enter the PIN of 4 or more digits. Right now my Firefox speaks Estonian but I also remember a ph

Re: Moving browser PKI forward (Re: Problem reading certificate from hardware token)

2009-07-04 Thread Martin Paljak
As I have written one of those "many plugins used in EU" (used in Estonia on Mac OS X and NPAPI compatible browsers, which means firefox/ safari/opera/camino ...), my opinions might be biased, but they reflect real life requirements. On 04.07.2009, at 1:04, Nelson B Bolyard wrote: FYI, to

Re: Problem reading certificate from hardware token

2009-07-04 Thread Eddy Nigg
On 07/04/2009 08:28 AM, Nelson B Bolyard: That's why I reason that the CA and user cert have to come from the same source, either the software storage or the token. But mixing the stores doesn't seem possible. Except that I do that all the time. True. Actually, I haven't seen evid

Moving browser PKI forward (Re: W3C Terminates XHTML2)

2009-07-04 Thread Anders Rundgren
Nelson B Bolyard Wrote. > This demonstrates that standardization is an option but an increasingly > difficult option as well in an ever faster-moving world: > http://www.w3.org/2009/06/xhtml-faq.html >Does it? >It appears to me that this is the standards body pruning the tree of >html offshoots,

Re: S/MIME in Thunderbird

2009-07-04 Thread Nelson Bolyard
I wrote: >> If Microsoft has merely taken a DER-encoded object from another standard >> and has incorporated it into a cert extension, that seems fine to me. >> I hope they did it in such a way that existing BER/DER parsers of the >> sMIMECapabilities attribute can just parse the extension body dir

Re: clarifications on TLS extension "Certificate Status Request"

2009-07-04 Thread Nelson Bolyard
On 2009-07-01 15:48 PDT, Nagendra Modadugu wrote: > I'm asking for implementation requirements :-) Client behavior is > straightforward, here are the outstanding questions about server behavior: Ah, OK, thanks for clarifying that. > Should it be possible to statically configure an NSS server wit