Recent events have highlighted that certification -- and the lack of accountability in signing files, code signing or SSL certificates -- have become a major security issue affecting the Internet. Watch F-Secure's Mikko Hyppönen, Chief Research Officer, and Sean Sullivan, Security Advisor, discussing on this topic.
Well, I have seen that trust-list in the browser before and it's too long.
Ideally the user should have to build it based on information received via some other transport, like a "cert card" from the bank, google, e.t.c.
But that's just in-practical, I somehow think they should follow the dns system in trust path. ".com" is signed with root, "somesite.com" is signed with ".com".
But I do not think it would solve a lot, unless it can be done localized.
Maybe SSL should be like PGP keys?
Tricky.
erlendse 9 months ago