Symantec OpenID Seatbelt calls OpenID providers fake when Convergence is enabled about convergence HOT 4 CLOSED

This is cause convergence returns it's own certificate, and the OpenID Seatbelt extension is basically checking the list against a list of pinned certs that came with it. The only solution I can see, is Symantec/Verisign running a notary with a pinned list of those certs.

The question really is, why are we trusting Symantec/Verisign, i.e. one of those evil C.A.s? :P

from convergence.

If the Mozilla guys were still working on their OpenID-supporting in-browser authentication upgrade rather than that BrowserID thing that I'll do anything in my power to see fail, I wouldn't need it.

As is, I don't really care beyond it being the most polished, reliable way to streamline use of OpenID in the browser.

from convergence.

Yeah, unfortunately, until Mozilla gives us an actual API to do cert validation so that we can stop doing this MITM crap, it's just going to be incompatible. =(

from convergence.

Fair enough. Is there a feature request for such an API that I should be voting for on bugzilla?

from convergence.