Hacker News Reader

Comment by heinrich5991 | Hacker News Reader

Other browsers do not have their own certificate stores but use those provided by the OS. Next interesting things are whether Windows and Mac OS X add the root certificate. I think Linux distributions tend to follow Mozilla's trust.

View on HN

RE: Linux, You're correct, they're provided through the ca-certificates package[0]:

"It includes, among others, certificate authorities used by the Debian infrastructure and those shipped with Mozilla's browsers. "

RE: OSX - If you can get into Mozilla's trust stores, it's the same steps (and pro forma, more or less) [1]

[0] https://packages.debian.org/wheezy/ca-certificates

[1] https://www.apple.com/certificateauthority/ca_program.html

Historically ca-certificates has included certificates that Mozilla had declined to include due to lack of audits, most notably the SPI root certificate because some Debian infrastructure relied upon it. They've also generally been relatively slow in removing root certificates after they're removed upstream, despite any removal essentially being a security issue. I think as of six months or so ago there is no longer any difference between ca-certificates and upstream.

Since Google is already cracking down on OEMs modifying the Android root store for various countries, I think it would make sense for Chrome to have the same root store as Android does (especially in light of Lenovo's Superfish, Dell's eDellroot and so on).

Chrome already has the ability to de-trust things trusted at the OS level, FWIW. It might be interesting to see how many OEM-installed certificates they could de-trust by default.

Reply on news.ycombinator.com