Subject: Re: [TLS] Deployment ... Re: This working group has failed

From: Peter Gutmann <[email-masked]>
Date: Sat, 30 Nov 2013 04:07:06 +0000

Andy Lutomirski <[email-masked]> writes:

>Not at all.  I didn't say "bundled set of trust roots;" I said "explicitly
>chosen".

We already have explicitly-chosen trust roots, they're chosen by the browser
vendors.  Or are you expecting granny to select CAs herself?  And once you've
decided to "trust" enough CAs to make the web usable, how do you deal with the
fact that many of these same CAs will happily sell their certs to phishers,
drive-by download sites, and all the other stuff that they're supposed to be
protecting us from?

>Do you really think that "completely insecure against active attack" is a
>good option?

No, but I don't see what that has to do with trusting or not trusting CAs.

Peter.