6 ms·
Most of this is beyond my understanding of TLS, but the first time I read about CT my first thought was, “So Google is pushing a technology that would let them
by cle 6y ago
Most of this is beyond my understanding of TLS, but the first time I read about CT my first thought was, “So Google is pushing a technology that would let them know about every new HTTPS domain on the Internet?”
Am I right to be suspicious about Google’s motivations here? It may very well also be the case that CT also improves security, but part of me feels...dirty, knowing that I can’t opt out of this mechanism that sends data straight to Google about any new HTTPS domain I set up, so they can start indexing it. Is this just the cost of improving trust?
- thayne 6y agoFirst of all, as I understand it anyone can access it, not just google. Secondly, if you don't want to be indexed by Google, there are better ways to do that (like a robots.txt). Finally, I suspect Google would be more interested in using this as a tool to figure out which sites not to index, because they have fishy (or phishy) certs, than trying to find obscure domains that have slipped under their radar.
- cle 6y agoI know there are mechanisms to customize Google’s crawler on a domain. That’s not what I’m objecting to, I’m objecting to the loss of control over my data.
- moviuro 6y agoYou can actually opt out of that mechanism: you can use your own, untrusted CA. The point of CT is to improve trust, and I seriously have doubts trusting the 300 independant (?) CAs my browser "trusts" [0]. Sure, having an infinite, append-only log of domain names for which an HTTPS certificate ever was issued sounds like a GDPR issue. But if it also helps catch bad actors before they can even set up their phishing pages, I'm all for it. [0] https://hg.mozilla.org/releases/mozilla-beta/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt https://hg.mozilla.org/releases/mozilla-beta/raw-file/tip/se...
- dadrian 6y agoGoogle already knows about the domains, they run a web crawler...
- cle 6y agoHow else would they know about it unless the CA told them?