If users can't configure their Facebook privacy settings I'm not too optimistic about their ability to manage root certificate trust bits. It's a good start tho

If users can't configure their Facebook privacy settings I'm not too optimistic about their ability to manage root certificate trust bits. It's a good start though. Ideally OS/Browser vendors would drop compromised CAs. That happened with DigiNotar. It's not always an option though — the three largest CAs have a 83.97%[0] market share. Dropping any one of them breaks the internet. Unfortunately a lot of people seem hell bent on destroying rather than improving on top of it. [0] https://ssl.netcraft.com/ssl-sample-report/CMatch/certs https://ssl.netcraft.com/ssl-sample-report/CMatch/certs