New Firefox Plug-In Double-Checks So-Called Unsafe Sites

The software, a free download for use with latest version of the Firefox Web browser, creates an additional way for people to verify whether the site they're trying to visit is authentic.

Who Can You Trust?

The problem, the Carnegie Mellon researchers say, is that many people are perplexed about how to proceed once they get one of those warnings about a bad certificate.

Some click through, going on to malicious sites that steal their personal information, while others retreat, skipping over harmless sites that used less expensive, "self-signed" certificates.

BS Detector

So the researchers -- David Andersen, Adrian Perrig and Dan Wendlandt -- created a program that performs a novel extra step. It can tap into a network of publicly accessible servers that have been programmed to ping Web sites and record changes in the encryption keys they use to secure data.

Any discrepancy can be a sign that hackers are rerouting traffic through machines under their control, a pernicious type of attack known as a "man in the middle."

As a result, the new program either overrides the security warning if a site is deemed legitimate, or throws up another warning if the subsequent probes reveal more red flags.