[GEEK] The BIG LIE of certificate checking

Maybe you've read or heard my rants about what has become known as the "Scary Dialog Box" that users see when the run a Java application without a valid certificate. And if you have used BlogBridge, you will have seen it and many of you have asked what the heck it means, and I am sure many more have chosen not to run BlogBridge because of it. Sun has heard this complaint from many many people and is now trying to fix the problem, by introducing this new alternative dialog box to report the same thing. There's a post and a thread about this here. Here's what you see if your application is signed with a verified certificate: Is this an improvement? Yes. Is it good enough? No! IMHO the whole idea of using certificates to sign applications is fatally flawed. It provides illusory security. As a small developer, all I have to do to make it go away is to spend some number of hundreds of dollars to get a certificate from Verisign or one of the many other CAs. When I do this, the message then becomes this: How is the user any more secure? Any malware developer could do the same thing. Of course they are smart enough so their company name wouldn't show up as " Malware Developer" and the application wouldn't be called "Big Bad Virus." How is the user to know? So my problem with this whole signed application certificate thing is that it gives the user a very false sense of security. Technorati Tags: java, security, webstart