Opinion: EV-SSL is a good thing, but it's more important to know when something's wrong than when it's right.Web browsers are such an important and, by now, mature application, youd think theyd have error messages down. But in fact theyre pretty bad at them. Even routine errors like mistyped addresses present messages that are confusing to novices. The Web is simple when everything works right. Of course, it doesnt always work out that way.
One of the more confusing subjects to explain when things go wrong is SSL. IE7 made some improvements in this area, and the Mozilla Group is working on making Firefox 3 easier to deal with in error conditions.
Both browsers support EV (Extended Validation) certificates, which are a new class of SSL certificates. EV certs are very expensive certificates issued only to incorporated organizations after actual background checks. To some extent, older versions of SSL were supposed to do the same thing, but over the years laziness and price wars diminished the authoritativeness of the older SSL regime. So you might say that EV certs represent a "do-over" for the trusted certificate industry.
eWEEK Labs Director Jim Rapozas test of the Firefox 3 Alpha many months ago found it unready for normal users. Click here to read more.
The EV cert standard also defines a new set of browser behaviors, including turning the address bar green when an SSL site is authenticated with an EV cert. KDE, Microsoft, Mozilla and Opera have all joined the CA/Browser forum which defines the rules for these certificates (but not Apple). This blog entry talks about the Mozilla plans for EV-SSL support in Firefox 3.
Its all well and good to engender confidence in users of the Web sites they are using. Banks, commerce sites, governments and so on may be able to justify the cost of an EV-SSL cert to make sure customers know when they see their site that its the genuine article. Ive seen some talk about hacks to fake EV-SSL, generally by faking the address bar, and Im not impressed with them.
But this is, at best, only half the problem. The real problem is for users to learn to expect the green bar and to learn to interpret the screen in front of them when its telling then that something is wrong, as opposed to right. This is the real failing of modern browsers and of the Web in general.
One of the Firefox developers, Bob Lord, blogged recently about the problems in SSL errors and what theyre doing about it in Firefox 3. He lists a number of erroneous situations that have to be covered, and there often seems to be a trade-off between clarity and brevity, since complex matters are involved.
This blog by Jonathan Nightingale talks about the same problem and examines the IE7 approach. Nightingale likes the IE7 error message for one of the SSL errors, where the domain on the cert doesnt match the domain requested by the browser. But hes bothered by the idea of including a link to allow the user to easily go on the site anyway. He thinks that such actions shouldnt be casual, so he argues for a multi-step process that reinforces with the user the fact that theyre bypassing a security protection.
Hmmm...Maybe some things will be getting harder to do in Firefox 3. This seems to be Nightingales message, that it will err more on the side of safety than convenience, and this is the message from Lords blog as well. But simultaneously he acknowledged that many error messages are cryptic and need to be made more human-readable. Hes right that both can be done. It also sounds like there will be ways to bypass the warnings, effectively whitelisting sites against such errors; these whitelists will be techie features.
The ideal situation is that site admins will get a lot of grief from users as life becomes inconvenient for Firefox 3 users, and they will demand the errors be fixed. With a group as big and influential as Firefox users, this could happen to some degree, but Id put more money on users demanding hacks to turn off the new "protections." Firefoxs developers may be doing the right thing, but users dont always take kindly to that.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983.
Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers blog Cheap Hack
More from Larry Seltzer
Network Security & Hardware 
