Mailing-List: contact dev-help@cordova.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cordova.apache.org
Received-SPF: pass (athena.apache.org: local policy)
From: Josh Soref <jsoref@blackberry.com>
To: Cordova Dev <dev@cordova.apache.org>
Subject: Re: Support self-signed certs in FileTransfer
Thread-Topic: Support self-signed certs in FileTransfer
Thread-Index: Ac72iOuBIDBlYCdMSHmiBQg1lUcVqQ==
Date: Wed, 11 Dec 2013 15:51:56 +0000
Message-ID: <20131211155156.24318101.61301.7374@blackberry.com>
Accept-Language: en-US, en-CA
Content-Language: en-US
Content-Type: text/plain; charset="iso-8859-1"
Content-ID: <723AE55E14ABFA4C9462A0539A9265F7@rim.com>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

Ian wrote:
> There was some talk on the list a couple months ago about this -- not for
> file-transfer specifically,
> but the general idea of supporting custom
certificates, or CAs in Cordova.

This came up yesterday in the office.=A0

> I think that, after a number of emails, we concluded that for users who
> have legitimate custom certificate requirements, that there should be
> os-policy-level mechanisms for adding custom certs, and that the individu=
al
> application was the wrong level to be managing them.=A0

I made the opposite argument. Users will not be able to do anything useful =
with global stores. The result is that unrelated applications will still / =
misappropriate certificates. =


Google is supporting zero trust:
http://www.scmagazine.com.au/News/367057,googles-plan-to-kill-the-corporate=
-network.aspx

http://www.darkreading.com/perimeter/forrester-pushes-zero-trust-model-for-=
se/227500145

While you might be OK with a prompt to enter an RSA token, you could easily=
 not recognize that the requesting party shouldn't be given it.=A0

Browser developers failed miserably the first time that client certificate =
UI was designed - Neither the "automatic selection" nor the "prompt user fo=
r certificate" choices work safely.=A0


---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential info=
rmation, privileged material (including material protected by the solicitor=
-client or other applicable privileges), or constitute non-public informati=
on. Any use of this information by anyone other than the intended recipient=
 is prohibited. If you have received this transmission in error, please imm=
ediately reply to the sender and delete this information from your system. =
Use, dissemination, distribution, or reproduction of this transmission by u=
nintended recipients is not authorized and may be unlawful.