Version: (using KDE KDE 3.2.0) Installed from: Debian stable Packages OS: Linux There exists a free CA that will issue needed certificates to anyone free of charge, namely cacert.org. I'd like to see their root certificate included in kssl, so that using this free resource becomes more feasible. Check out http://www.cacert.org/ It is looking like the root certificate is about to enter Mozilla, and while that's not very relevant to KDE per se, it is worth checking out the Mozilla bug for a discussion of good reasons to include this root certificate: http://bugzilla.mozilla.org/show_bug.cgi?id=215243
It's also relivant to view the news://news.mozilla.org/netscape.public.mozilla.crypto newsgroup as well, as the discussion moved from their bug to the news discussion.
Afaik Mozilla has still not accepted it, and I don't have enough information or resources to accept it yet either. This will have to wait until one of the two aforementioned situations change.
What information do you require?
Check http://www.onlamp.com/pub/wlg/5142 . Lets fix this bug.
Still not in IE or Mozilla?
Nope. I think we can forget about IE. With IE, it is just about the stamp from American Institute of Certified Public Accountants, which is expensive. Mozilla Foundation may develop an independent policy, which KDE may or may not want to follow. I don't know the status of that work. It is definately a policy question this, so it is possible that the KDE Project should formulate its own policy, but it is a difficult issue.
*** This bug has been confirmed by popular vote. ***
Based on discussions with people involved in CAcert, we have decided that this won't happen. There are apparently transparency problems with this "open" CA. http://article.gmane.org/gmane.comp.security.cacert/1378 http://article.gmane.org/gmane.comp.security.cacert/1186 I consider this case closed.
Ahem, two months have passed, and I believe many of the "transparence problems" have since been resolved. A new board has been elected and the code on which cacert.org is based has been opened for inspection. while cryptography is an especially sensitive issue at all times, and transparency always is a main issue in cryptography; just how transparent are institutions such as verisign and thawte? *Can We Trust Them?* I would like to ask the more knowledgable than myself to re-inspect the situation at cacert.org and re-open this case
As of 20050518, CAcert is included in debian ca-certificates package, as shown in http://packages.debian.org/changelogs/pool/main/c/ca-certificates/ca-certificates_20050518/changelog [quote] add CACert.org's Root CA closes: Bug#213086, Bug#288293 [/quote] Getting accepted by debian might mean something about trust. Also, about Comment #9, these links are handy: http://www.verisign.com/developer/notice/authenticode/index.html http://www.eweek.com/article2/0,1759,1767871,00.asp And surprisingly: http://www.benedelman.org/spyware/images/installers-020305.html Paying for certificates does not add extra security, it seems :)
Is it time to reopen this, given that more information came to light since it was closed?
It is important to establish an open certificate authority. This bug appears to have been closed for political/economic interests rather than on technical grounds. It definitely should be reviewed.
I'm getting sick of receiving comments about this. It will not happen with our current system, period. There is clearly a major inability to comprehend the trust infrastructure for SSL, and the state of the system today. Don't expect any response from me [maintainer of the CA database] about further queries on this topic.
Does there need to be another bug opened then, for the KDE project to make its system capable of comprehending trust?
Has anything changed since 09/2005, or are there any plans for something to change? It seems like KDE lacks a policy for handling such matters.
We have a policy, and nothing has changed. Once a webtrust audit is successfully passed and it is accepted by Firefox and/or Microsoft, and looks suitable to us (which is the easiest of the three criteria), it may be accepted.
Sorry - don't mean to pester. Is the policy published? Mozilla does not require a webtrust audit (any 3rd party will do), so you might have #1 without #2. Obviously there are legal issues, so it might be a long time before we see a free cert provider given the US legal system (the irony being that it is safer to go with Verisign (who has issued false certs in the past (for no less than MS), and not cacert (which would require the hijacking of a domain to spoof) - all because of an expensive 3rd-party audit).
The policy is that it must be in Netscape Navigator (we are using Firefox as an equivalent now), or in MS IE. It has been that way for a long time, and was decided on mailing lists. I am the only one with commit access to the database.
*** Bug 127292 has been marked as a duplicate of this bug. ***
CAcert is included in most major distributions now and used by quite many prominent sites (FSF, GNU Savannah), still KDE will just follow Microsoft? I won't object if it is rejected on technical bases, but is policy of following Microsoft the best that KDE can do? Don't want to offend anyone, it just sounds stupid to me.
RapidSSL (http://www.rapidssl.com/) grants a certificate to anybody who is smart enough to buy a mobile phone with a prepaid SIM, without any authentication whatsoever. No id required, an no credit card required either, if you only need the certificate for 30 days (FreeSSL). Yet their certificate (bearing the issuer CN "Equifax Secure Global eBusiness CA-1") is still accepted by konqueror. For the sake of consistency, konqueror should either accept CaCert which is more secure (you need to convince at least to geeks that you are who you claim you are), or they should remove Equifax (you only need to know about prepaid mobile plans, or, for that matter phone booths which allow call in. These exist in France, and probably other places as well). IMHO, the latter is far easier to abuse. This whole certificate business is a sad joke.