4 ms·
CT is a passive tool that doesn't really help to prevent incidents. In the 2017 Brazilian bank hack [1] Let's Encrypt denied any wrongdoing and clearly stated
by alexey-salmin 2y ago
CT is a passive tool that doesn't really help to prevent incidents.
In the 2017 Brazilian bank hack [1] Let's Encrypt denied any wrongdoing and clearly stated that DV means nothing more than DV (that is reasonable). These certificates were logged in CT but it was only discovered afterwards.
[1] https://www.wired.com/2017/04/hackers-hijacked-banks-entire-online-operation/ https://www.wired.com/2017/04/hackers-hijacked-banks-entire-...
- mkj 2y ago"Kaspersky believes the attackers compromised the bank's account at Registro.br" I don't think DNSSEC would have helped there either. That's an interesting case study, thanks for posting it.
- tptacek 2y agoCT alters the economics of large-scale misissuance, actively, by creating consequences for it. CAs have been distrusted for issues detected by CT. That's not "passive".
- TheNewsIsHere 2y agoYou’re right. I would suggest that the commenter is right in spirit but the framing and the word “passive” aren’t compatible. CT is passive in that it provides an ability to be reactive, but it isn’t a proactive technology. It can’t “actively” do anything other than tell you something has happened.