3 ms·
I wonder if it would be possible to configure a browser (or an entire OS) to use TOFU on the CA level. "Hey, this page uses a cert signed by $THIS_CA, would yo
by LeoPanthera 4y ago
I wonder if it would be possible to configure a browser (or an entire OS) to use TOFU on the CA level.
"Hey, this page uses a cert signed by $THIS_CA, would you like to trust it?"
Then instead of shipping whitelists, you could ship blacklists, which is presumably simpler and more future proof.
- pionar 4y agoHow would I know if I should trust $THIS_CA? That's why it's good that the browser vendors do this, they know better than me which ones are trustworthy.
- LeoPanthera 4y agoThis whole story seems to prove that that isn't true.