2 ms·
Because businesses that don't want those zones to MITM them will move to zones that do support SCTs. It's not as strong a reason as Mozilla and Chrome arm twis
by cryptonector 3y ago
Because businesses that don't want those zones to MITM them will move to zones that do support SCTs. It's not as strong a reason as Mozilla and Chrome arm twisting WebPKI CAs, as sovereigns can resist longer, but eventually it will happen.
- tptacek 3y agoJust so we're clear, this is like saying that CT would have happened on its own, just because of market pressure from certificate customers, without Mozilla or Google intervening.
- cryptonector 3y agoI'm not sure how CT for DNSSEC would happen. If we had a spec and implementations then we could get market pressure applied. Mozilla and Chrome might have security indicators on their browser that incentivize the use of TLDs that provide better security. And again, I think DNSSEC already has things that WebPKI doesn't have that give it some advantages in terms of security. CT is not a panacea either, since it requires that people pay attention to what CAs issue certificates for.