3 ms·
Indeed. For example, none of those CA in the built-in bundle in my browser ever asked me to trust them, that's how I know they are trustworthy.
by Joker_vD 2y ago
Indeed. For example, none of those CA in the built-in bundle in my browser ever asked me to trust them, that's how I know they are trustworthy.
- Brian_K_White 2y agoYou were asked by the browser publisher to trust them. But those are merely defaults which you do posess ultimate control over, unlike the blobs and secrets in various bits of hardware.
- Joker_vD 2y agoNo, I wasn't "asked" by the browser publisher to trust them unless you use the word "ask" in a very broad (almost to the point of meaninglessness) sense: when I installed my browser, it simply started using its pre-packaged bundle of CA certificates. Which it regularly updates, I imagine, although it also never asked me about what the update source I'd like to use either. You can say that I implicitly trust the browser vendor's judgement in what CAs to trust, by the virtue of using the browser, and I'd agree with that. But saying that I was asked by the browser publisher to trust them? No, I disagree, I wasn't. It was a silent decision.
- Brian_K_White 2y agoAsk as in expect.