3 ms·
If it was all CAs by default, but then allowed you to remove the ones you didn't trust, then that would help a lot. Then the vast majority of users will be goin
by brobdingnagians 8y ago
If it was all CAs by default, but then allowed you to remove the ones you didn't trust, then that would help a lot. Then the vast majority of users will be going with the browser recommended CAs, but advanced users can customize. If there was a distribution format for experts to "vote/warn" on which CAs are trusted, then you could subscribe to their lists with a common configuration of (Trusted by All, Trusted by At Least One, Not Warned By Any, Not Warned by All). That way you could get updates automatically from your favorite experts. We often outsource things like reviewing all the advisories in this way. Now we just need someone to develop this in. Could it be done as an extension?
- olliej 8y agoI don’t know about windows or Linux, but you can already do this on Mac. Keychain access let’s you change trust settings of each root, including individual “purpose” granularity (eg restrict to just mail servers, etc)