[Cryptography] "Trust in digital certificate ecosystem eroding"

[grarpamp]

> Browsers were being paid by CAs to include their certificate ...
> so the CAs could sell certificates (paid for by merchants).

Yes, the common downfall... what starts as a two party crypto game
which works, devolves into a third party money game that fails.

> The browser vendors are the top level CAs.

No, you cannot trust third parties, especially ones you do not have
on paid contract with you.

Both the browsers and the CA's are untrustable third parties.
As with CA's, we already know "the market" does not work there.



Like people said, use the service self publishing its key in DNS,
(secondarily verifiable by your PKI WOT to them).
Bootstrap "." from your OS or a friend.
Move to TOFU and pinning and calling your bank as needed.
Use with observatories if your DNS isn't used
in a secure fashion yet or you're some sort of target.

Note that the actual count of services you routinely use over any
time interval is likely entirely manageable, say 25 to 50 or so.
Add in a few more for CDN's and the like.

Worst you're the same security as with CA's... none.
Best you eliminate them and move to something stronger
or distributed away from the direct MITM and money issues.