Re: Draft finding - "Transitioning the Web to HTTPS"

Mark Nottingham wrote:
> That’s a good question. I’m not a UX person, and don’t pretend to be one.
> My issue is that the user isn’t warned at all, and the default — power to MITM — is surprising,
> unless you understand how PKI works.

> In a perfect world, browser trust stores would only allow CAs to be installed if they have name constraints (perhaps respecting the public suffix list).
> Since that horse has already bolted, it’s more difficult.

I don't think it's intractable [1].

[1] https://lists.w3.org/Archives/Public/www-tag/2015Jun/0007.html