Hacker News Reader

I fully encourage you folks to prune your trusted CAs. I personally whitelist only some CAs. I keep a separate root for visiting Chinese websites like Baidu Wenku.

View on HN

it is frankly astonishing how many browsers/OS platforms ship by default trusting all of the major mainland chinese root CAs.

It’s astonishing because somehow the Chinese deserve to be treated differently from everyone else?

Because the Chinese government has a well documented track record of attempting to MITM SSL, and if your system trust the root CA... game over.

https://www.google.com/search?q=china+ssl+mitm&ie=utf-8&oe=u...

Reply on news.ycombinator.com