News for hackers. Stuff that matters.

A comment on Tarsnap: No heartbleed here. Parent comment

Re:Tarsnap: No heartbleed here by jlgaddis on Thursday April 10, 2014 @08:59PM (#7570664)
> It should be the user who has the final decision over which certificates to trust. Users are the real "Certificate Authorities". They should have full control over encryption and decryption should they want to exercise it.

And they do.

I'm not sure what you're getting at here. You and I and my mother all have the ability to edit the root CA certificates on our computers and add our own, if we wish.

[ Parent | on HN ]
Re:Tarsnap: No heartbleed here by yp_master on Thursday April 10, 2014 @10:03PM (#7570868)
Indeed, that has been my solution.

But I'm seeing more and more authentication information being incorporated ("baked in", pre-installed, whatever) into browsers, whether it is lists of "valid" TLD's, certificates for "approved" CA's, or chosen individual website certificates.

Personally, I think this information should be cleanly separated from the software that may use it rather than pre-installed and "hidden from the user".

[ Parent | on HN ]