<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Alexander Klink wrote:
<blockquote
cite="mid:20070907.ce9a944b0ad262ed5b5f8b8bee21485f@cynops.de"
type="cite">
<pre wrap="">
Here is how it works:
- Because Firefox's standard configuration is to automatically choose a
TLS client certificate to be sent out, the certificate including
the personal data will now be sent out to any website that requests it.
Contrary to a typical cookie, this includes websites that are on a
completely different domain. The user will not notice this at all.
</pre>
</blockquote>
Personally I'd prefer to have the default settings for "When a website
requires a certificate" to be "Ask me every time". Specially if one has
various certificates from the same CA, the clueless user logs in always
with the first certificate on the list. Not really something one might
expect.<br>
<br>
However information stated in certificates signed by CAs isn't usually
"private" and depending on the CA policy even published via directories
and other different channels, so I'm not sure if this could be an
invasion of privacy. Also tracking visitors can be done in different
ways and doesn't have to be with cookies - again I'm not sure what's
the difference. IChanging the default selection for certificate
authentication could solve the problem you stated in any case. Perhaps
file a bug for this?<br>
<br>
<blockquote
cite="mid:20070907.ce9a944b0ad262ed5b5f8b8bee21485f@cynops.de"
type="cite">
<pre wrap="">
What other browsers do:
- Firefox 1.5: Does not allow you to install a client certificate that
is from a CA which you don't trust. I still believe this was a decent
default setting.
</pre>
</blockquote>
Are you sure there was a change? I don't remember this to be the case
of pre-2.0 Firefox either.<br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>