We are looking at adding the ability for enterprise security administrators to lock various parts of the Navigator configuration so that the user can not change them, including stuff relating to trust and certificates. This functionality will not be in 2.0, but we do consider it important for certain customers. --Jeff P. Rajaram wrote:
Yes. But... I deal with the security infrastructure for a large corporation. I want only security administrators to configure the list of acceptable CAs. I specifically do not want our users to be able to add new CAs to the list of trusted "approved" CAs.
The concern is that some users who are not crypto enthusiasts may be "social engineered" into adding a very liberal CA to their list. Once this happens, the browser's signature verification capability is totally compromised.
This is one of the reasons why PGP has not been adopted by many large companies. In response, Viacrypt now seems to have a product that can restrict user modifications to the public keyring.
-raj
-- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw@netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.