Re: Open then gates
Christoph Anton Mitterer <calestyo@scientia.net> writes:
> Another nice (IMHO) example are the X.509 that are shipped per default
> in several places (Mozilla NSS, ca-certificates).
> Per default all of them are enabled... right?
> Mozilla recently proved that they are not really able to manage they
> cert store.... giving the fact that they even didn't know where a
> root-cert came from an how has control over it.
> And personally, I really do _not_ trust some of the CAs which are
> included/enabled per default.
Having done business with several of them, I don't trust any commercial
CA. This is a way more fundamental problem. Essentially no X.509 used on
the Internet uses trustworthy CAs. X.509 for web authentication is, in
practice, not an authentication mechanism. It's solely an encryption
mechanism. It's almost trivial to bypass the authentication portion if
you're familiar with the business practices of the CAs.
Again, this is really not a Debian problem. To require secure CAs, we'd
have to essentially disable SSL browsing for our users by default. There
is no widely used Linux distribution on earth that's going to make that
choice.
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: