search

namecoin / Convergence

Secure peer-to-peer DNS resolution and HTTPS authentication for Firefox, without certificate authorities, using the Namecoin blockchain. This repo is deprecated in favor of https://github.com/namecoin/ncdns and https://github.com/namecoin/dns-prop279
https://bit.namecoin.org/freespeechme.html
27 stars 26 forks source link

Create signing certificate on installation time #3

Closed domob1812 closed 10 years ago

domob1812 commented 10 years ago

Convergence should create the certificate that is used to issue ad-hoc site certificates on installation time instead of when starting the browser. That way, it would be possible to use it with a master password set but without entering the master password on each browser start (only once when installing Convergence).

See also http://forum.namecoin.info/viewtopic.php?f=7&t=1627.

khalahan commented 10 years ago

Oh, that is the reason why Convergence it asking the master password at each start. I would like to avoid entering the password at each start too. Plus, people should wonder why it does this and this can bring suspicion.

JeremyRand commented 10 years ago

@domob1812 I looked through the code, and it looks like it's not the certificate creation that triggers the password dialog. The certificate is created only once, the first time it runs. The password dialog appears to be caused by the FreeSpeechMe proxy wanting the ability to sign things with that certificate. I don't think there's any way around this, other than running the upcoming XULRunner port instead, and using a shorter password for the XULRunner app.

domob1812 commented 10 years ago

Ok. I don't store any critical info in Icedove/Firefox anymore, so I don't need a master password - and thus, this issue is resolved for me. If you believe it is not easily fixable, feel free to close the PR. I still think that it may be a major hurdle for users to enter the master password when opening the browser each time, though.

JeremyRand commented 10 years ago

Yeah, it's certainly not ideal. I'll close this issue for now, but if anyone has a proposal for a better workaround, feel free to post and I'll reopen it.