2 ms·
I wouldn’t consider it “solved” because most organizations and people don’t actually check the log. And a malicious actor can abuse this fact.
by harrall 11mo ago
I wouldn’t consider it “solved” because most organizations and people don’t actually check the log.
And a malicious actor can abuse this fact.
- crote 11mo agoHaving Chrome/Firefox asynchronously check the CT log 0.1% of the time would probably be enough to solve that. CT logging is mandatory, and even a single missing cert is probably going to be an existential threat to any CA. The fact that someone is checking is already enough of a deterrent to prevent large-scale attacks. And if you're worried about spearphishing-via-MitM, you should probably stick to Tor.
- wakawaka28 11mo agoHow will you establish a connection to the CT log server? Seems like you need a separate way to handle that.