Hacker News new | past | comments | ask | show | jobs | submit login

Indeed. For example, none of those CA in the built-in bundle in my browser ever asked me to trust them, that's how I know they are trustworthy.





You were asked by the browser publisher to trust them.

But those are merely defaults which you do posess ultimate control over, unlike the blobs and secrets in various bits of hardware.


No, I wasn't "asked" by the browser publisher to trust them unless you use the word "ask" in a very broad (almost to the point of meaninglessness) sense: when I installed my browser, it simply started using its pre-packaged bundle of CA certificates. Which it regularly updates, I imagine, although it also never asked me about what the update source I'd like to use either.

You can say that I implicitly trust the browser vendor's judgement in what CAs to trust, by the virtue of using the browser, and I'd agree with that. But saying that I was asked by the browser publisher to trust them? No, I disagree, I wasn't. It was a silent decision.


Ask as in expect.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: