Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You're thinking of the CAB, which dictates which CAs are trusted. Google is a participant in that. The things they dictate are public and have to do with security requirements, not whether or not they pay Google money.


This is not true! CAB is a place where CAs and browsers agree on what the rules for CAs should be. Google, Mozilla, Microsoft and Apple all administrate their own root stores which individually decide what CAs are trusted on their platforms. Individual root stores decide on the rules for inclusion in their stores themselves, but these rules are essentially: You follow CAB rules + a few extra things. Mozilla for example requires (besides CAB rules) that whenever a CA becomes aware of an issue, they post a bug to bugzilla and get their shit together pretty quickly and keep mozilla up to date on what they're doing.


This would feel a lot more like a relevant nit to pick if there were actually meaningful differences where I might go get a TLS cert and find it's trusted in Chrome but not Firefox or vice versa.


Chrome vs Firefox doesn't matter that much, but more significantly windows trusts more CAs than Chrome and Firefox. Not sure about the exact amount, but it seems to be somewhat significant amount. You can take a look at https://www.ccadb.org/resources I looked at it but couldn't quickly get a number, so no number in my comment.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: