Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm just wondering if this is dubious practice considerig that the OS vendor might not have been externally audited for example about how safe the private key is etc.

Is there any references to "rules" about stuff like this?

share|improve this question
    
Could you re-word that perhaps? Are you saying that browsers should not include particular "OS companies" root CAs? Is this only with reference to Windows and IE? –  scuzzy-delta Jan 26 '11 at 22:08
    
This should be submitted as a community question, not as a regular question. You may want to delete this one and re-create it as a community question before a mod sees it. –  Daisetsu Jan 26 '11 at 22:41
    
this is not a reference to one specific OS, but I am wondering if there exists some sort of rules or guidelines/general consensus about this. I am not specifically soliciting the personal opinion of users here on SU. I can see that they use it for updates for example, but if they add themselves to browsers, they give the impression to have been audited properly for security. –  ufotds Jan 26 '11 at 23:35
add comment

1 Answer 1

You think they are trustworthy enough for the rest of the operating system, why not the encryption? If they wanted a backdoor, they could easily add one anywhere.

For example, Apple has two CAs in Keychain Access, equally trusted as the other 161 more real CAs like Verisign (AOL is apparently trusted.. didn't know that). I would guess that Apple went through the same process as the others, but I doubt it'll be confirmed publically.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.