Re: lynx-dev Re: Your distribution of openssl-0.9.7a-os2-bin.zip

[Stef Caunter]

Interesting. The quality of a certificate source is at the heart of any such
discussion. Because it is almost impossible to accept and trust certificates
upon first suspicious presentation to a lynx user, it is a security win, and as
long as a good source is found as part of the procedure involved in trusting
a host the security is good.

I was reading a security post from about 3 years ago referring to lynx as
vulnerable to MITM attacks due to its ssl naivete. I suggest that this is no
longer the case as long as FORCE_SSL_PROMPT:PROMPT is default, and the NO
setting is deprecated.

On Tue, 14 Oct 2003, Ilya Zakharevich wrote:

> > So I can say that lynx accepts connections to secure webservers as
> > long as the issuer certificate of the servers certificate is in
> > cert.pem or SSL_CERT_DIR.

I hope this is deducible from README.sslcerts; with that environment variable
available and a hash of the cert.pem in the directory there is no ssl error.

> > This is slightly different to mozilla because mozilla has the
> > possibility to accept certificates from dedicated servers too.

An important difference, in that the trusted source must be known to be secure,
which is not the case if a cert is accepted upon first suspicious presentation.
The step whereby you acquire a trusted copy and install it confirms identity.
This cannot be emphasized enough. Mr. Woolley has been a strong advocate of this
reality for many years.

> > In mozilla you have 4 different types of certificates.
>
> > a) Certificates of Authorities. This is equal to lynxs SSL_CERT_FILE
> >    or SSL_CERT_DIR

It's just another cert; a root CA cert, self-signed but known to be trusted,
or commercial and trusted to the root can be installed into lynx to trust all
certs issued by that CA. Any valid, not expired, correctly named cert issued
by a trusted CA should itself be trusted.

> > b) Server certificates, not available in lynx
>
> Used for what?

If I understand, this is the case of installing one cert from one secure host
from a known good source, and using lynx to communicate securely thereafter.

>
> > c) my own certificates, stored together with my personal key. This
> > is needed to connect to servers which request a client certificate
> > for authentication. (N/A in lynx?)
>
> I think it is applicable.  Not sure about availability though.  Anyone
> knows?

I don't know if we can present client certificates in lynx; not aware of any
mechanism. Anyone else?

>
> > d) Other peoples certificates, needed for sending encrypted mails. (N/A in 
> > lynx)
>
> I do not know about mailto: stuff, does it support encription?

Sounds like SMIME, not in play here, but certs do work nicely in several
mail clients.

__Stef
<address@hidden>
http://caunter.ca/contact.html

; To UNSUBSCRIBE: Send "unsubscribe lynx-dev" to address@hidden