As opposed to what? Using the OS's trust store? Getting the user to manually trust CAs?
What if the browsers (and OS) didn't default-trust anyone? The various CA companies would have to include the general public in their public relations. We'd see CAs advertising for users to trust their roots. If a CA ever screwed up, they would feel it.
Another part of the rot is that TLS certs can only have one root CA. If I decided I don't trust DigiCert, I would effectively cut myself off from Hacker News, because a site can only have one root CA. If a site could have multiple CAs, I would still be able to connect so long as I trusted one.
Why should I trust Digicert for example? When did I make that decission?
What does 'trust' mean if the decission is made by others?
Shouldn't there be an easy way to configure it to trust that?
If there is something running on 127.0.0.1:8716 which I have not given permission to run then my machine is compromised already. No?
The credentials in WebAuthn are bound to an FQDN (typically the name of the web server but e.g. news.ycombinator.com would be entitled to ask for WebAuthn credentials for ycombinator.com) so it's not as though this is irrelevant.
I can imagine a few dozen extra lines defining a special allowance for localhost in the WebAuthn spec., but then you're also building a bunch of special backend code to handle that too and for what?
I built a toy WebAuthn implementation to understand it better, but I did it on my vanity site, and I don't feel like it would really have been easier without.
The mozilla CA program for instance, requires potential CAs to go under audits. Is what you're proposing (requiring CAs to hire an advertising/PR department to convince users) really an improvement? Bad companies can lie in either case, but at least the former feels like less waste of resources. Furthermore, forcing the user to make this decision significantly increases the social engineering risk. If the average users have to add a few dozen CAs every time they get a new computer, it will be very easy to social engineer them to add one more. See for instance, social engineering users into downloading and running malware payloads by saying they need to "update their flash player" or "install a codec".
>If a CA ever screwed up, they would feel it.
Nope, the too big-to-fail problem will still exist. Facebook fucked up, yet we're all still using it. Consumer boycotts rarely work. At least with browser vendors there's a unified bargaining group for users. Good luck getting measures like distrusting symantec or limiting certificate validities to 398 days via grassroots action.
How would the general public create an open source operating system if the people paid to do it for a living have problems doing it?
The "general public" definitely isn't writing an open source operating system. That would be an even bigger disaster.
If you want to, you can contribute to both, just as you can edit your trusted certs list. But making that the default would be awful.
https://groups.google.com/g/mozilla.dev.security.policy
For example m.d.s.policy is currently considering an application from NAVER Business Platform, a South Korean outfit and I'm quite sure that a native Korean IT person could usefully contribute to the discussion.
And when was this, precisely? The copy of Netscape 1.0 I looked at didn't even have a UI to configure CAs.
CAs have screwed up in the real world. And the result of those screw-ups were removal from root cert lists. And they closed down as a result. DigiNotar and WoSign both faced this calamity.
There was a time when root stores let anyone in who asked nicely. That time has long since passed however; the modern process is quite involved. See Mozilla's process here: https://wiki.mozilla.org/CA/Application_Process, and note that it calls out that it's expected to take two years to complete. It's not a pro forma policy: the Federal PKI [1] was not able to meet the requirements of inclusion into the root store because its rules for issuing certificates are not considered sufficient per modern browser requirements.
Quite frankly, I'd place far more trust in Mozilla's ability to audit CAs than my ability to do it myself, and I'd trust the average user's ability even less than myself. Arguing that CAs having to advertise to the user is a good idea for trust ignores the fact that unsavory companies openly abuse their users and yet still have high trust. (To say nothing of politicians...)
[1] This is the PKI system that's mandatory within the US government for internal certificates.