3 ms·
What about if the UX of the Root Certificates management gets betters? In OSX keychain you can just click on e.g. the DoD CA root certificates and permanently u
by rmoriz 13y ago
What about if the UX of the Root Certificates management gets betters? In OSX keychain you can just click on e.g. the DoD CA root certificates and permanently un-trust them globally.
We need an easy and good UX for every new thing, so why not improve the usability of the existing X.509 world instead of re-inventing the wheel?
Eg. S/MIME support in recent versions of Mail.app and iOS mail got really nice. There is improvement, it's currently just enterprise-driven.
We need to talk to the industry leaders like Google and Mozilla to fix their horrible X.509 browser experience and make this thing available/usable to/for consumers, too.
- jcase 13y agoIf users can't configure their Facebook privacy settings I'm not too optimistic about their ability to manage root certificate trust bits. It's a good start though. Ideally OS/Browser vendors would drop compromised CAs. That happened with DigiNotar. It's not always an option though — the three largest CAs have a 83.97%[0] market share. Dropping any one of them breaks the internet. Unfortunately a lot of people seem hell bent on destroying rather than improving on top of it. [0] https://ssl.netcraft.com/ssl-sample-report/CMatch/certs https://ssl.netcraft.com/ssl-sample-report/CMatch/certs
- sigsergv 13y agoIt's really hard sometimes to find DoD CA certs. It could be hidden in some chain starting with proper non-DoD CA for example.