4 ms·

> The user should be the one controlling the list of trusted CAs and servers, not a third party such as ad-supported company or organization distributing a web

by vacri 9y ago

> The user should be the one controlling the list of trusted CAs and servers, not a third party such as ad-supported company or organization distributing a web browser. No, they really shouldn't. Security is a ridiculously complex arena, and the amount of knowledge you need to make an intelligent setup on this is considerable. For tech-heads, fine, but the vast majority of people are not tech-heads. If you switched over to this model, we'd end up in the bad old days of Windows XP, where untrained people would advise untrained people to 'just install this package and everything works!' and half the time they'd be installing malware. The right way to do this is 'sensible defaults, that the user can adjust'.

aseipp 9y ago
The funniest part of this ongoing debate I see -- to me, at least -- is that the end result is, effectively, one of two options. Given the way we as a society use technology, today: 1) Piss off the like, 10,000 technical nerds who care about this, by having sensible defaults. "We should really teach people to fully manage their CA chain! It sucks I have to spend 20 minutes doing this once a year after spending 10,000 hours learning how computers work." 2) Don't piss them off, but in return, get ready for user-blaming whenever someone messes up, and for your users to be 'responsible' for themselves. "If users were EDUCATED and not so stupid, they'd be able to spend 100 hours understanding the CA system and keep themselves secure!!! Not our fault if you install certificates from Brazilian hackers" I dunno, it's mostly an observation, even if it's something of a false dichotomy, but this always seems to be the way it goes. Technical users simply have vastly different value systems. But honestly, my go-to strategy these days is mostly "whenever most technical people try to give security advice and speak on behalf of most users, almost always: do the exact opposite thing, in order to keep the users secure". Most of us have some variant of Stockholm Syndrome to some extent.
- JauntyHatAngle 9y ago
  >The funniest part of this ongoing debate I see -- to me, at least -- is that the end result is, effectively, one of two options. Given the way we as a society use technology, today Speaking more generally, rather than specifically about CA chains, I respectfully disagree with you there. Imho, what usually happens in a sane world, is that we spend most of the time between these two extremes, in a pendulum as we balance one way, get burned, go back the other way, get burned again and repeat. Im fine with it being that way until someone releases a true ground breaker and redefines what we are balancing. >But honestly, my go-to strategy these days is mostly "whenever most technical people try to give security advice and speak on behalf of most users, almost always: do the exact opposite thing, in order to keep the users secure". I think I understand what you are saying, but that comes across as you cherry picking the bits of a technical persons advice that a layman wouldn't understand. The "exact opposite" is sorta hard to define.
- snowwrestler 9y ago
  It seems to me that if someone is truly an expert, they should already be able to manually manage their certificate authorities if they want to. It's just a list stored somewhere on their computer, after all, and at least 2 major browsers are open source and can be forked into a private repo for personalized development. What I see in this thread looks more like an insidious middle: people who think they are experts, but are asking browser providers to do the development to change the entire product and provide a nice friendly UI. This seems like an area where the old maxim applies that if you have to ask for help, maybe you're not as expert as you think you are.

by vacri 9y ago

aseipp 9y ago

The funniest part of this ongoing debate I see -- to me, at least -- is that the end result is, effectively, one of two options. Given the way we as a society use technology, today: 1) Piss off the like, 10,000 technical nerds who care about this, by having sensible defaults. "We should really teach people to fully manage their CA chain! It sucks I have to spend 20 minutes doing this once a year after spending 10,000 hours learning how computers work." 2) Don't piss them off, but in return, get ready for user-blaming whenever someone messes up, and for your users to be 'responsible' for themselves. "If users were EDUCATED and not so stupid, they'd be able to spend 100 hours understanding the CA system and keep themselves secure!!! Not our fault if you install certificates from Brazilian hackers" I dunno, it's mostly an observation, even if it's something of a false dichotomy, but this always seems to be the way it goes. Technical users simply have vastly different value systems. But honestly, my go-to strategy these days is mostly "whenever most technical people try to give security advice and speak on behalf of most users, almost always: do the exact opposite thing, in order to keep the users secure". Most of us have some variant of Stockholm Syndrome to some extent.

JauntyHatAngle 9y ago
>The funniest part of this ongoing debate I see -- to me, at least -- is that the end result is, effectively, one of two options. Given the way we as a society use technology, today Speaking more generally, rather than specifically about CA chains, I respectfully disagree with you there. Imho, what usually happens in a sane world, is that we spend most of the time between these two extremes, in a pendulum as we balance one way, get burned, go back the other way, get burned again and repeat. Im fine with it being that way until someone releases a true ground breaker and redefines what we are balancing. >But honestly, my go-to strategy these days is mostly "whenever most technical people try to give security advice and speak on behalf of most users, almost always: do the exact opposite thing, in order to keep the users secure". I think I understand what you are saying, but that comes across as you cherry picking the bits of a technical persons advice that a layman wouldn't understand. The "exact opposite" is sorta hard to define.
snowwrestler 9y ago
It seems to me that if someone is truly an expert, they should already be able to manually manage their certificate authorities if they want to. It's just a list stored somewhere on their computer, after all, and at least 2 major browsers are open source and can be forked into a private repo for personalized development. What I see in this thread looks more like an insidious middle: people who think they are experts, but are asking browser providers to do the development to change the entire product and provide a nice friendly UI. This seems like an area where the old maxim applies that if you have to ask for help, maybe you're not as expert as you think you are.