<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt">Eddy,<br><br>> On 02/13/2012 07:43 PM, From Francisco Corella:<br>> > OK, that says you use keygen to generate a key pair in Firefox (an<br>> > ActiveX control in IE). But you still have to use JavaScript to<br>> > import the certificate into the browser. AFAIK that's the only way<br>> > you can automatically import a certificate into the browser with<br>> > current technology. In Firefox you must be using<br>> > crypto.importUserCertificates(), is that right?<br>> <br>> No, that's wrong, we simply push the certificate to the browser in the<br>> correct format and headers. Browsers like Firefox know what to do with<br>> it in case it finds a valid key pair.<br><br>Thank you for pointing that out, it's interesting.<br><br>I guess you mean that if the relying
party downloads a certificate in<br>the body of an HTTP response with a content-type header whose value is<br>a MIME type indicating that the body contains a certificate, and if<br>Firefox "finds a valid key pair" then Firefox will import the<br>certificate automatically. Did I guess right?<br><br>Well, depending on the details, that could be a security hole. If the<br>valid key pair that Firefox finds consists of the publick key in an<br>existing certificate and the associated private key, Firefox could end<br>up replacing the existing certificate with one downloaded by an<br>attacker that binds the public key to the attacker's identity. That<br>could cause the user to log into an account controlled by the<br>attacker, and to enter other sensitive data into the account, making<br>it available to the attacker.<br><br>Is this Firefox feature documented somewhere? If so could you send
a<br>link?<br><br>Thanks,<br><br>Francisco<br><br><div><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Eddy Nigg (StartCom Ltd.) <eddy_nigg@startcom.org><br> <b><span style="font-weight: bold;">To:</span></b> Francisco Corella <fcorella@pomcor.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "openid-general@lists.openid.net >> 'openid-general'" <openid-general@lists.openid.net>; Karen Lewison <kplewison@pomcor.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, February 13, 2012 5:46 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re:
[OpenID] OpenID Providers Invited to Join in an NSTIC Pilot Proposal<br> </font> </div> <br>
<div id="yiv1977773322">
<div>
<br>
On 02/13/2012 07:43 PM, From Francisco Corella:
<blockquote type="cite">
<div style="color:rgb(0, 0, 0);background-color:rgb(255, 255,
255);font-family:times new roman, new york, times, serif;font-size:12pt;">OK, that says you use keygen to generate a key
pair in Firefox (an<br>
ActiveX control in IE). But you still have to use JavaScript to<br>
import the certificate into the browser. AFAIK that's the only
way<br>
you can automatically import a certificate into the browser with<br>
current technology. In Firefox you must be using<br>
crypto.importUserCertificates(), is that right?<br>
</div>
</blockquote>
<br>
No, that's wrong, we simply push the certificate to the browser in
the correct format and headers. Browsers like Firefox know what to
do with it in case it finds a valid key pair.<br>
<br>
<br>
<div class="yiv1977773322moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a rel="nofollow" target="_blank" href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a rel="nofollow">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a rel="nofollow" target="_blank" href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a rel="nofollow" target="_blank" href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</div>
</div><br><br> </div> </div> </blockquote></div> </div></body></html>