3 ms·
Why is checking for certificate revocations theater? It seems sensible to me. Edit: I mean downloading a revocation list rather than checking online.
by papaf 13y ago
Why is checking for certificate revocations theater? It seems sensible to me.
Edit: I mean downloading a revocation list rather than checking online.
- tptacek 13y agoBecause the real world breaks OCSP checks often enough that browsers can't tell the difference between e.g. a malfunctioning proxy and an attacker; therefore, browsers don't hard-fail the checks, so attackers can slip past them. And in exchange for that theater, you're telling the CAs what sites you're visiting. It is a crazy system.