4 ms·
IIRC the plan was to force users to manually install a root certificate (controlled by the government) on their devices. Local roots are exempt from any CT enfo
by pfg 9y ago
IIRC the plan was to force users to manually install a root certificate (controlled by the government) on their devices. Local roots are exempt from any CT enforcement. Naturally, you can just not install the root certificate, but if all traffic is intercepted, I'd expect most users to do so to get around the warnings.
- jopsen 9y agoThat probably only works if the root cert is mandated in all OEM installs... And still you probably won't find any Linux distros with this support. Note. incepting all traffic sounds expensive and very dangerous, ie. risk or leaking grows when you scale. It's probably better to only use it for select users. Curious, why future versions of chrome would not force CT for official TLDs?
- pfg 9y ago> Curious, why future versions of chrome would not force CT for official TLDs? This would cause all corporate MitM proxies to fail. Certificates generated by these devices cannot be logged to the CT log servers accepted by browsers (they only accept certificates chaining back to a trusted root). Local roots were exempt from HPKP pins as well, so this is just keeping with existing policy.