cross-posted from: https://infosec.pub/post/6945259
Let’s talk about root certificate management and the EU proposed QWACs.
Steve Gibson of the security now podcast weighed in with opposition to the EUs proposed QWACs certs and cited a few other prominent figures also expressing opposition.
Paragraphing their concerns, they proposed that mandating a bunch of new CAs introduced more risk and greater opportunity for abuse or compromise. Steve favors less CAs also being in favor pruning out most, but 6 or 7.
At the moment, I don’t care for browsers having their own certificate stores, as I would rather use the OS which I would use group policy for windows or use an automation tool for Linux.
I am also in favor of pruning out certs, though I’ve never tested that in an enterprise.
Does your organization allow non OS certificate stores?
Does your organization prune out default root certs?
How do you feel about the proposed QWACs?
The real issue with QWACS is the idea that the EU government requires them to be added to web browsers running in the EU. It’s bad enough that France and Germany can issue those certificates but imagine Erdogan’s government pushing them out.
It’s not like any politician knows how the Internet works and that someone who knows better couldn’t rip those certificates out, but the tyranny of the default means that governments will have more control over EU citizens browsing. That’s not something likely to benefit anyone.