3 ms·
Will non-browser clients like curl/requests ever support checking CT logs? It's great that some browsers have it, but browsers are not the only clients using TL
by fruitreunion1 3y ago
Will non-browser clients like curl/requests ever support checking CT logs? It's great that some browsers have it, but browsers are not the only clients using TLS with CAs. Also doesn't help that a lot of software can't use CA root stores with much granularity: https://news.ycombinator.com/item?id=33876949 https://news.ycombinator.com/item?id=33876949
- agwa 3y agoHopefully, although there are challenges to overcome. CT is a fast-moving ecosystem, with logs coming and going, and policies changing regularly. This requires CT-enforcing clients to be very on-the-ball with updates, both in the sense that the developers need to pay attention and update their code in time, and any users of the apps need to upgrade frequently. Browser makers can handle this because they are competently-staffed and well-resourced. The authors of non-browser apps need to know what they're getting into. A cautionary tale: there is a library for adding CT enforcement to Android apps. Earlier this year, every app using this library was suddenly unable to establish any TLS connections because Google stopped publishing a JSON file which the library should never have been consuming in the first place. There was plenty of warning that this would happen, but the author of the library was not on-the-ball. https://groups.google.com/g/certificate-transparency/c/38Lr9K46cCA/m/mtwe68NTHwAJ https://groups.google.com/g/certificate-transparency/c/38Lr9...
- NovemberWhiskey 3y agoThe elephant in the room is that TLS implementations for browsers and those in the libraries of common programming languages have diverged really substantially: Web PKI is massively more restrictive and depends on a bunch of technology that's not in the baseline PKI.