[8organicbits]

Can you explain?

I think the parent is suggesting that users should be able to tune their trust stores. I'd imagine that trusting only the CAs that are in all the major trust stores (Google, Microsoft, Mozilla, and Apple) would be a reasonable policy. Few websites would choose a CA that falls outside that group.

[tptacek]

Users can tune their own trust stores.

[8organicbits]

Is there a way to do it that isn't tedious? I'm not familiar with tooling beyond the UI browsers offer, which doesn't match the experience I was trying to describe.

[dadrian]

The next version of Chrome introduces a whole UI for this at chrome://certificate-manager.

[salawat]

I mean... It's as easy as getting SSL certs and importing them into a trust store/adding them to a directory.

The hard part is getting the people you want to establish a trust relationship with to give you a copy of their key. Web of Trust was the answer to logistical key distribution problem. The idea being there would be an organization that would vet people and vouchsafe their cryptographic material for everyone else.

The problem of course, is that the more invisible this is to users, and the more unintuitive the actual mechanics, the more valuable cracking the CA's becomes for hostile actors because of the ensuing blast radius compared to the boast radius that would result from theoretically getting the practice of key exchange in the public, and getting them to internalize the act of creating their own trust networks.

Of course, if you have dreams or fantasies of being able to control people, none of the work that goes into educating the populace is ever going to be endorsed, because once everyone realizes that they can at least assure their own safety by not delegating their cryptography, the entire idea of eacesdropping as a third-party by tapping the line is unmade. Which is not a popular state of affairs universally.

[8organicbits]

Web of trust is way more ambitious than what I'm talking about. Key distribution for the Apple, Microsoft, Google, and Mozilla trust stores is already a solved problem and works well at scale already.

However, if you don't trust the inclusive nature of Microsoft's trust store and prefer Chrome's, there should be a tool to swap out trust stores. I don't think such a tool exists yet.

[resters]

Right. I'm imagining a tool that would let users impose choices such as the following:

- Accept any certs trusted by Bruce Schneier unless they are not trusted by tptacec

- Do not accept new certs for top 1000 domain names unless they are over 7 days old and trusted by the Mozlla Foundation

Various experts could create the rules they use to decide which certs or CAs they trust and users could decide which high profile authority figures or institutions they want to trust. One example might even be "Bruce Schneier paranoid version"

I think this doesn't exist because of the following:

1) technically it is possible to do it today with the existing tools, even though nobody does it

2) the negative impact of trusting certs one shouldn't is low for the average user

3) sophisticated users already take precautions and are rarely fooled

I think for something like this to work it would have to be extremely simple. Surely there would be the same phenomenon as "Dr. Oz" in the realm of cyber secruity. Maybe the 'Kevin Rose settings" would be popular, etc. But that would still open the door to distributed trust which is an improvement over blanket trust of large corporate entities.