3 ms·

> and let's be realistic here, this means Google. Actually, it doesn't. There are four main browser CA root stores: Apple, Microsoft, Mozilla, and Google, and

> and let's be realistic here, this means Google. Actually, it doesn't. There are four main browser CA root stores: Apple, Microsoft, Mozilla, and Google, and these are also the root stores of their respective operating systems (if you're on Linux, you're using Mozilla's root store, because distros do not want to run anything themselves). Furthermore, the Microsoft, Google, and Mozilla root stores all also require inclusion in the common CA database, which is run by Mozilla. Also, Mozilla (and maybe Google) require CAs to participate in Mozilla's public lists, especially when it comes to notifying people of big CA security oopsies--all of the big CA issues have come to light on that list, and the coordination of the responses by browsers has been done by Mozilla. So the biggest authority on who a valid CA is? Mozilla.

SiempreViernes 5y ago
So, what you're saying is that Mozilla could sanction Russian CAs such that nobody would trust them?
- Thiez 5y ago
  They theoretically could, but why?
- aaomidi 5y ago
  No because that trust in Mozilla is only placed there because they only care about CAs operating properly. Nothing else.
- tialaramex 5y ago
  First there would have to be Russian CAs. There aren't any. Most likely because Russians wouldn't trust a Russian CA, so what's the point setting one up? If against the odds somebody had built a trustworthy Russian CA and it was currently in the root trust store for Firefox (and so likely everything else) then we might have this question to ponder, although the answer is likely "No" since this hypothetical CA isn't doing anything wrong, but that's a hypothetical very different from reality.
- jcranmer 5y ago
  In principle, they could. In practice, you need a really good reason to do so. And "government-owned" isn't even sufficiently good reason, although "government-mandated MITM" is (see the banning of some Kazakhstan CAs for that reason).

SiempreViernes 5y ago

So, what you're saying is that Mozilla could sanction Russian CAs such that nobody would trust them?

Thiez 5y ago
They theoretically could, but why?
aaomidi 5y ago
No because that trust in Mozilla is only placed there because they only care about CAs operating properly. Nothing else.
tialaramex 5y ago
First there would have to be Russian CAs. There aren't any. Most likely because Russians wouldn't trust a Russian CA, so what's the point setting one up? If against the odds somebody had built a trustworthy Russian CA and it was currently in the root trust store for Firefox (and so likely everything else) then we might have this question to ponder, although the answer is likely "No" since this hypothetical CA isn't doing anything wrong, but that's a hypothetical very different from reality.
jcranmer 5y ago
In principle, they could. In practice, you need a really good reason to do so. And "government-owned" isn't even sufficiently good reason, although "government-mandated MITM" is (see the banning of some Kazakhstan CAs for that reason).