4 ms·

Devil's advocate on your devil's advocate: what legitimate reason could an OEM have for installing a root certificate?

• MichaelGG 12y ago
  Same as MS? Maybe they feel they have a better idea on who to trust and thus add and remove certificates as necessary. Maybe they want to sign their own hardware drivers (though, I think those don't use the system CA store). Perhaps they want to offer signatures to customers or software vendors and feel current MS provided CAs are lacking. More mundane, perhaps there's a cheaper CA that's accepted by some trusts, but not MS. Why should MS be trusted more than $OEM? OK, fairly weak arguments, but the freedom of doing so is important. Just as it is important that users be able to verify and undo and choose their root of trust. The concept of a global root of trust breaks down pretty fast. And the OEM can already compromise anything anyways.
  • sjwright 12y ago
    > Same as MS? Maybe they feel they have a better idea on who to trust How would the consumer know who they're trusting?