4 ms·

Exactly. I've never understood why all the US / EU language versions of Chrome, Firefox, etc. include all the root certs for CAs from China, Turkey, Russia, etc

Exactly. I've never understood why all the US / EU language versions of Chrome, Firefox, etc. include all the root certs for CAs from China, Turkey, Russia, etc. I cannot read Mandarin or Turkish, and in the unlikely event I get forwarded to a site from a company targeting citizens from these countries, I'd prefer to just get an SSL exception instead of the 'trusted' page.

nl 9y ago
What about the huge number of English language Chinese run ecommerce sites? Why should they be discriminated against because of their native language? That just makes the normal user who wants to buy stuff learn to ignore SSL errors.
- hamandcheese 9y ago
  Is it unreasonable to expect a foreign ecommerce site to use a CA that it's users can trust?
  - nl 9y ago
    Yes, absolutely. I think the @grandalf idea of selectable trust list providers has some merit (although there are some security trade-offs there). I don't think the automatic mistrust of certificates from "CAs from China, Turkey, Russia" automatically follows from that.
  - vacri 9y ago
    You're right. Americans should discard Turkish and Chinese CAs in favour of one homed in the heart of their tech capital in Silicon Valley. Clearly those foreign ones are shysters and not to be trusted like a locally-built, trustworthy business! Oh, what's that? Symantec is an American company, headquartered in Mountain View, CA?
    - jrochkind1 9y ago
      Meanwhile, the rest of the world probably wonders if they should trust American CA's! I'm not sure a geographically silo'd internet is what we should be going for. i miss the days when the dream of the internet was prefiguring a borderless world.
- d33 9y ago
  Wouldn't you say it would be enough to pin those certs to TLDs?
  - nl 9y ago
    By TLD do you mean country domains? Then absolutely not. Why should a US company not be allowed to use a Swiss-issued certificate for a .io domain name?
    - duskwuff 9y ago
      And for that matter -- if a CA really is untrustworthy, why should domains under any TLD be exposed to them?
- hiram112 9y ago
  Did you not miss the part where I referred to my 'localized' version of Firefox or Chrome (i.e. US English)? For example: https://www.mozilla.org/en-US/firefox/organizations/all/ https://www.mozilla.org/en-US/firefox/organizations/all/ Again, I cannot read Mandarin or Turkish, and likely never ever will. It seems to me that it'd be much more likely that a site, even if run by Chinese or Turks, caters to American customers, should invest in a certificate trusted by a US CA, and similarly for every market they expect to do business in. And likewise, I don't know why localized versions of browsers for the Chinese market would include trusted certs from Turkey or Brazil. Seems like its a lot easier to force multinational companies, who already are going to have to invest in huge amounts of research and technology to deal with foreign taxes, currencies, bank accounts, etc., to add to their burden the responsibility for obtaining certs from their customers' local CAs, instead of having every single CA on Earth be trusted by all releases of browsers.

nl 9y ago

What about the huge number of English language Chinese run ecommerce sites? Why should they be discriminated against because of their native language? That just makes the normal user who wants to buy stuff learn to ignore SSL errors.

hamandcheese 9y ago
Is it unreasonable to expect a foreign ecommerce site to use a CA that it's users can trust?
- nl 9y ago
  Yes, absolutely. I think the @grandalf idea of selectable trust list providers has some merit (although there are some security trade-offs there). I don't think the automatic mistrust of certificates from "CAs from China, Turkey, Russia" automatically follows from that.
- vacri 9y ago
  You're right. Americans should discard Turkish and Chinese CAs in favour of one homed in the heart of their tech capital in Silicon Valley. Clearly those foreign ones are shysters and not to be trusted like a locally-built, trustworthy business! Oh, what's that? Symantec is an American company, headquartered in Mountain View, CA?
  - jrochkind1 9y ago
    Meanwhile, the rest of the world probably wonders if they should trust American CA's! I'm not sure a geographically silo'd internet is what we should be going for. i miss the days when the dream of the internet was prefiguring a borderless world.
d33 9y ago
Wouldn't you say it would be enough to pin those certs to TLDs?
- nl 9y ago
  By TLD do you mean country domains? Then absolutely not. Why should a US company not be allowed to use a Swiss-issued certificate for a .io domain name?
  - duskwuff 9y ago
    And for that matter -- if a CA really is untrustworthy, why should domains under any TLD be exposed to them?
hiram112 9y ago
Did you not miss the part where I referred to my 'localized' version of Firefox or Chrome (i.e. US English)? For example: https://www.mozilla.org/en-US/firefox/organizations/all/ https://www.mozilla.org/en-US/firefox/organizations/all/ Again, I cannot read Mandarin or Turkish, and likely never ever will. It seems to me that it'd be much more likely that a site, even if run by Chinese or Turks, caters to American customers, should invest in a certificate trusted by a US CA, and similarly for every market they expect to do business in. And likewise, I don't know why localized versions of browsers for the Chinese market would include trusted certs from Turkey or Brazil. Seems like its a lot easier to force multinational companies, who already are going to have to invest in huge amounts of research and technology to deal with foreign taxes, currencies, bank accounts, etc., to add to their burden the responsibility for obtaining certs from their customers' local CAs, instead of having every single CA on Earth be trusted by all releases of browsers.