3 ms·
Only if they use it irresponsibly. A certificate tightly controlled by a three letter agency and used for spot interceptions on specific targets is very unlike
by brohee 4y ago
Only if they use it irresponsibly.
A certificate tightly controlled by a three letter agency and used for spot interceptions on specific targets is very unlikely to be found.
Massive interception are likely to be detected nowadays, but the lone political opponent is still far from safe from them.
- Gigachad 4y agoIt should be possible for browsers to flat out reject any certificate that isn’t in the transparency logs. Not too sure if they do that currently but I can’t see why they couldn’t.
- brohee 4y agoFor the same reason they don't use the CRL, it very hard and expensive to scale, and in any case what to do if you cannot access the CRL/transparency log? An entity in position to intercept can simulate an outage as well..
- nickf 4y agoThat's not quite how CT works. The client doesn't (currently) need to have any access to the CT logs themselves. Generally, a 'pre' certificate is submitted to a number of logs by the CA. The log returns a signed timestamp. These SCTs (signed certificate timestamps) are embedded in the final certificate provided to the subscriber - and the browser can verify those. (The SCTs can also be stapled, and not signed into the certificate itself).