3 ms·
That you've disabled some of the Mozilla roots is laudable. However you're still trusting every other root to trust their intermediaries to trust their intermed
by rrix2 9y ago
That you've disabled some of the Mozilla roots is laudable. However you're still trusting every other root to trust their intermediaries to trust their intermediaries and on and on to trust the people they issue certs to. This is fundamentally how the modern internet works. The same is true for DNS as SSL.
As for your solution: a web of trust is also transitive, unless your depth of trust is one. If your depth of trust is one, the only way you're productively browsing the internet is by doing TOFU for every single cert at which point I have other questions.
- pdkl95 9y agoYou're completely missing the point; this isn't about technical protocols, nor is it about minimizing trust. I can choose to agree with Mozilla or a root CA[1]. Trusting intermediaries does not necessarily involve transitive trust. Someone that trusts Mozilla does not necessarily also trust a 3rd party simply because Mozilla trusts them. Mozilla cannot simply force anyone to trust a 3rd party by fiat, and attempting to do so (such as in the current situation) can easily be seen as a betrayal. [1] re: root CAs and "trust the people they issue certs to" - that isn't how the current PKI system works. The CA is only vouching for the validity of a certificate. Trusting a CA's claims about the identify of the other end of a SSL connection is orthogonal to the trustworthiness of the 2nd party at the other side of the SSL socket.