4 ms·
Maybe we need a browser add on that warns us when a shady/incompetent CA has signed the certificate of the current site we are on? As it sits today there is no
by eyeareque 12y ago
Maybe we need a browser add on that warns us when a shady/incompetent CA has signed the certificate of the current site we are on? As it sits today there is no repercussion for these terrible CAs that screw up like this.
- eli 12y agoIf you don't trust the CA, you could just remove it from the root store of your OS or browser.
- eyeareque 12y agoTrue, but that is a manual process that most users don't know how to carry out. We need to make it easy for the masses to "punish" the terrible CAs. If you can put pressure on the bad CAs, they will at least try to get better.
- eli 12y agoUnderstanding SSL is already really hard. What is a user supposed to do with a warning about a valid cert from a questionable CA? The site is probably fine so you're mostly just teaching them to ignore SSL warning messages.
- eyeareque 12y agoThe idea is to cause at least a small percentage of users to distrust the cert/CA. This would cause the sites who buy CAs to avoid going with the shady CAs because of the user complaints they got after browser warnings were shown.
- mike_hearn 12y agoThe masses have no interest in fiddling with their browser settings. Ultimately the decision makers here are the browser makers (i.e. guys like agl).