3 ms·

Uh huh. And if I log what addresses reach out to me to check for the presence of a particular certificate in the logs? You're not thinking about it hard enough

Uh huh. And if I log what addresses reach out to me to check for the presence of a particular certificate in the logs? You're not thinking about it hard enough. Your CT's would effectively have to be implemented in a way where everyone had a locally cached copy of the log to check against. That at least shuts down an browsing activity leak vector. If you centralize it, the abuse is a matter of when, not if.

aaomidi 3y ago
> Uh huh. And if I log what addresses reach out to me to check for the presence of a particular certificate in the logs? Again, misunderstanding of how it works. Logs are checked using the SCT in the certificate. It's a signed "promise" from the CT that the pre-certificate will eventually be appended to the logs in a few hours since submission. The various root programs monitor to ensure that the promise does in fact happen. Your browser process does *not* reach out to the CT log on its own.