4 ms·
What browsers actually do that? And do all CAs support it? Besides, if you have enough access to the CA, you can just get whatever cert is in the transparency
by kadoban 3y ago
What browsers actually do that? And do all CAs support it?
Besides, if you have enough access to the CA, you can just get whatever cert is in the transparency log, though that's almost certainly harder for most nations and CAs.
- trifurcate 3y ago> you can just get whatever cert is in the transparency log That would require compromising the certificate requester.
- notabee 3y agoA lot of certificate management services for enterprise customers "helpfully" store the private key files. How many cloud or SaaS vendors automatically handle the private keys as well instead of them being generated and staying securely only on the systems using them? So there are still points of centralization to attack, potentially.
- astrange 3y agoYes, state actors have been known to steal things like codesigning keys. Microsoft had that happen recently where someone with persistence on a dev machine sniffed them out of crash logs(!). But it requires a lot more steps.
- astrange 3y ago> What browsers actually do that? Chrome, Safari, Firefox. > And do all CAs support it? Yes, the browsers made them. > Besides, if you have enough access to the CA, you can just get whatever cert is in the transparency log No, the CA doesn't have the private key of certs.
- kadoban 3y agoThat's great! I guess my knowledge is out of date, happy to be wrong about that. > No, the CA doesn't have the private key of certs. Woops, yeah good point.