Hacker News Reader

Comment by VMG | Hacker News Reader

How to disable CAs on firefox (thanks user nmc):

The GUI way: https://wiki.mozilla.org/CA:UserCertDB#Deleting_a_Root_Certi...

The CLI way: http://unix.stackexchange.com/a/285831

Chrome/Chromium: search "certificate" in settings to get to the certificate manager, edit trust settings for certificates.

View on HN

How can laypeople know which certs can currently be trusted? Is there a list of ratings somewhere, or maybe a whitelist of some kind?

I'm working on such a project. The ratings are based on a few well-defined criteria. Stay tuned!

How do I stay tuned? Sounds quite interesting.

Potentially useful to that end: https://git.cryto.net/joepie91/ca-incidents

Be aware that there are known issues with the certificate manager, and some changes may not work as you expect: https://bugzilla.mozilla.org/show_bug.cgi?id=585352

Don't forget to disable them in Android (and iOS?), too.

Remember that editing the root CA store is not possible on Android Nougat anymore, to prevent MitM proxies for adblocking or debugging apps you didn't develop.

It's still possible to remove CA certificates from the trust store on Android Nougat. It's also possible to use custom CAs for apps that explicitly opt into trusting custom CAs.

> not possible on Android Nougat anymore, to prevent MitM proxies for adblocking or debugging apps you didn't develop

That certainly makes the Nougat taste a bit sour. And Chrome doesn't even support ad block on mobile.

Let's hope Firefox gets its act back together.

Btw, more info: https://news.ycombinator.com/item?id=12061320

You are certainly welcome.

Reply on news.ycombinator.com