4 ms·
As you well know, browsers come configured with an endless list of CAs that "the user trusts", including CAs from various nebulous governmental entities from al
by zurn 13y ago
As you well know, browsers come configured with an endless list of CAs that "the user trusts", including CAs from various nebulous governmental entities from all over the world. And they are all good for authenticating any .com domain.
The UI you speak of is almost never invoked, unlike with the DNSSEC model where the address itself conveys information to the user in a form that even many non-technical users are accustomed to interpreting.
- tptacek 13y agoYou've totally missed the point. As I acknowledged in the comment you just replied to, nobody uses the crappy certificate UI in browsers. The fact that the UI exists means it is possible to change your certificate list. It is not possible to have users configure different DNS roots. DNS is part of Internet connectivity.