3 ms·
Those CAs are at least accountable to browser vendors. (Symantec, for example, is currently in the process of having their root certs distrusted by Chrome and F
by Ajedi32 9y ago
Those CAs are at least accountable to browser vendors. (Symantec, for example, is currently in the process of having their root certs distrusted by Chrome and Firefox as a result of their violations of the BRs.) The same can't be said of private root certs like this.
- uxp 9y agoA good question to be asked might be why we are still conflating the certificate store used for software signing with the certificate store for domain validation. They're two entirely different problem domains using the same tool. Much like it doesn't make sense to use a drywall screw to join eyeglass frames together despite both attachment mechanisms requiring screws, it doesn't make sense to allow a system to validate a web domain as being trustworthy because an audio driver requires a certificate trust to validate itself as being legitimate. Most of this separation is done on good-faith already, but it should be done in a more discrete manner.