Chrome's Plan to Distrust Symantec Certificates
I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse.<p>The incentive for a mass-market browser is to trust pretty much everything, but I&#x27;d prefer to use a browser that is a bit more paranoid.<p>If a website can&#x27;t load properly because I don&#x27;t trust one or more of the CAs, I might want to temporarily &quot;live dangerously&quot; but would be a bit more cautious about typing data into a form, etc.<p>Browser vendors should not try to create a one-size-fits-all list of trusted CAs, since there is obviously a very different level of trust deserved by various CAs based on the track record of each one.<p>If I were a state actor intelligence agency, compromising CAs would be toward the top of my list because of the amazing opportunity for man-in-the-middle attacks.<p>Distrusting Symantec certificates is a great step in the right direction.