3 ms·
Have you seen the state of the root ca bundle? As far as I can tell it has every national CA except the US. Do you really trust the turkish government with the
by somat 3y ago
Have you seen the state of the root ca bundle? As far as I can tell it has every national CA except the US.
Do you really trust the turkish government with the ability to sign for any domain.
Some days I consider tearing out the whole thing and rebuilding with the 3 CA's I actually care about. but then I usually give up as too much hassle.
- cesarb 3y ago> As far as I can tell it has every national CA except the US. Annoyingly, it doesn't have my country's national CA hierarchy (https://bugzilla.mozilla.org/show_bug.cgi?id=438825 https://bugzilla.mozilla.org/show_bug.cgi?id=438825). Why is it annoying? Because it means you have to add it manually, and manually added root certificates have more power than the root certificates that come with the browser! In particular, they can bypass HPKP (security.cert_pinning.enforcement_level defaults to 1).
- snowwrestler 3y ago> Do you really trust the turkish government with the ability to sign for any domain. No, but I don’t have to. To be included in the root CA list, they have to participate in cert transparency logging. So I can just pick a log to monitor, and check to make sure they haven’t issued a cert for one of my domains.
- somat 3y agoSo you don't trust them to not issue an unexpected cert but you do trust them to always log it? edit: I just read the spec. the cert needs to be logged to be considered valid by the browser. which has fun connotations where google is effectively monitoring everything you access. basically the mother of all analytics. well... I mean... that is.. if they were not already monitoring everything you do on the web. so it's ok I guess.