<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Martin Paljak wrote:
<blockquote
cite="mid:EBFB9AFC-B40D-4594-A336-47D71287B639@paljak.pri.ee"
type="cite">
<pre wrap="">
Do I trust the 50+ 'authorities' pre-selected by somebody else for me
in Firefox? I doubt it. Do I trust the OpenID providers I've chosen to
use? More likely.</pre>
</blockquote>
<br>
So this is entirely off-topic (well, maybe it isn't), but it seems that
you have no clue about how CAs are admitted and governed in the
Mozilla NSS store. Not only is the full process of inclusion of a CA
performed publicly, a concrete set of policy [1] (and practices)
control inclusions and included CAs. The CAs in NSS are not just
"pre-selected by somebody" but each CA undergoes an not so easy
process, some are rejected entirely or held up for inclusion until
meeting certain requirements. Mozilla does provide a set of CAs
included within their software on behalf of the user, because it's very
inconvenient to read and understand of each CA its policies and
attestations in order to make a decision.<br>
<br>
OpenID providers don't have to undergo <b>any</b> vetting and don't
have to adhere to <b>any</b> outlined requirements and policies
whatsoever, so what you are saying here is absolute rubbish. Joe
Candoall may be an OpenID provider but certainly not a CA included in
NSS (or other software I guess). I suggest to be careful with such
baseless and bold comparisons if you don't know about it...else please
explain what is the basis of your trust in OpenID providers compared to
the Mozilla included CAs, because what you are saying right now is that:<br>
<br>
- I trust a provider which has his site hosted at some shared hosting
provider somewhere<br>
- I trust a provider which hasn't any policies and practices implemented<br>
- I trust a provider which doesn't need to meet any requirements
whatsoever<br>
- I trust a provider which hasn't undergone any wetting by a third party<br>
- I trust a provider which which doesn't have to take any responsibility<br>
- I trust a provider which doesn't give me any guaranties nor insight
about its authentication methods<br>
<br>
<br>
- I don't trust a set of CAs which <b>must</b> meet declared
requirements set forth by Mozilla...mmmhhh....<br>
<br>
<br>
[1] <a class="moz-txt-link-freetext" href="http://www.mozilla.org/projects/security/certs/policy/">http://www.mozilla.org/projects/security/certs/policy/</a><br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>