5 ms·

> Such a attack would immediately end up with the relevant CA being removed from the certificate stores across popular browsers/OS, quite detrimental to the bus

> Such a attack would immediately end up with the relevant CA being removed from the certificate stores across popular browsers/OS, quite detrimental to the business who owns them. Absolutely, but when I look at the list of CAs (~70) that are preloaded in browsers: * Most of them are unknown to most people => How to know if there is no malevolent CAs? * A relevant number are from countries that are not so free. => What power has a SME like Firefox against let's say Turkey, Hungary or China states?

Anunayj 4y ago
> How to know if there is no malevolent CAs CT logs make issuance of certificates very public, that allows the community to react to mis-issued certificates very quickly, this however doesn't stop a CA from just not submitting the cert to CT logs. Browsers like Google Chrome check the certificate in CT logs, and would refuse to work otherwise.
tengwar2 4y ago
Unless you need to deal with companies that use certificates from countries that you do not trust, why not just delete/distrust them? The organisation behind Firefox is the Mozilla Corporation, which is owned by the Mozilla Foundation. It's not particularly easy to find out what its legal status is, but that probably doesn't matter. It is not obliged to carry anyone's root certificates. There would be a market share cost for not doing so, but that's it.