3 ms·
> have the resources to acquire certificates and MITM high value information. Isn't that mitigated by certificate transparency?
by hiatus 2y ago
> have the resources to acquire certificates and MITM high value information.
Isn't that mitigated by certificate transparency?
- ls612 2y agoFor WebPKI yes it should be.
- eightysixfour 2y agoObviously this all depends on your threat model at the end of the day, but if assuming a state level actor, I don’t think it is that far fetched to assume they can acquire the original certificate.