News for hackers. Stuff that matters.

A comment on Mozilla to Certificate Authorities: no subordinate CAs for traffic interception. Parent comment

Re:Mozilla to Certificate Authorities: no subordinate CAs fo... by duskwuff on Saturday February 18, 2012 @02:51AM (#3606181)
For historical reasons (viz. NSS), Mozilla maintains its own list of trusted CAs. Chrome uses whatever is provided by the OS, so they aren't in a position to make the same sorts of demands.

Not that I disagree with the sentiment -- there's just a very specific reason why Mozilla is involved, and it's not simply because they write a web browser.

[ Parent | on HN ]
Re:Mozilla to Certificate Authorities: no subordinate CAs fo... by nknight on Saturday February 18, 2012 @03:26AM (#3606239)
Chrome could still maintain a blacklist of roots.
[ Parent | on HN ]
Re:Mozilla to Certificate Authorities: no subordinate CAs fo... by Maxious on Saturday February 18, 2012 @08:04AM (#3606516)
One was written after the DigiNotar incident: http://code.google.com/p/chromium/issues/detail?id=94673
[ Parent | on HN ]