3 ms·
Interesting note about public keys that are automatically trusted by proprietary operating systems, and the potential for abuse by foreign powers. Reminded me o
by TallGuyShort 16y ago
Interesting note about public keys that are automatically trusted by proprietary operating systems, and the potential for abuse by foreign powers. Reminded me of the discussion a while back about how it's relatively easy to become a root certificate authority in Firefox. Everyday cryptography needs some serious revamping.
- BCM43 16y agoThis is a good point, and it is something that the authors of http://web.monkeysphere.info/ http://web.monkeysphere.info/ are trying to solve. More info: http://web.monkeysphere.info/why/#index1h2 http://web.monkeysphere.info/why/#index1h2
- tptacek 16y agoBecause this project (sensibly) doesn't override X509 authentication, it does nothing to address the problem observed by the parent commenter, or for that matter the fever dream of the article we're commenting on. Thankfully, it is very unlikely that anything like this would ever see widespread adoption, thus allowing us to sidestep the question of how it might work if they turned X509 off.
- tptacek 16y agoThe UI for everyday cryptography needs some serious revamping. It's not relatively easy to become a Firefox root CA, but too many people are, and part of the reason why is that your cert store configuration is buried deep in the "don't touch, no user serviceable parts" bowels of your configuration.
- ohashi 16y agoAnd how does one fix/change it?