← Back to context Comment by hbcdbff 12 hours ago CT is great for browsers. Largely irrelevant for anything being fetched outside of a browser. 31 comments hbcdbff Reply woodruffw 12 hours ago That’s why I’m talking about it purely in the context of incident response/forensics. hbcdbff 12 hours ago You claimed CT would “definitive”ly prove whether it has or has not been exploited, which is false.The lack of CT entries only proves that (most likely) browsers were not MITM’d. cortesoft 11 hours ago We would still know if certs were issued, though, which is the thing we want to check 13 replies → tptacek 11 hours ago I'm not following. Browser or no browser, every cert eMudhra issues has to generate an SCT. 13 replies → KJs6ZxELzQM37O 7 hours ago CT is enforced in Android 17 by default.
woodruffw 12 hours ago That’s why I’m talking about it purely in the context of incident response/forensics. hbcdbff 12 hours ago You claimed CT would “definitive”ly prove whether it has or has not been exploited, which is false.The lack of CT entries only proves that (most likely) browsers were not MITM’d. cortesoft 11 hours ago We would still know if certs were issued, though, which is the thing we want to check 13 replies → tptacek 11 hours ago I'm not following. Browser or no browser, every cert eMudhra issues has to generate an SCT. 13 replies →
hbcdbff 12 hours ago You claimed CT would “definitive”ly prove whether it has or has not been exploited, which is false.The lack of CT entries only proves that (most likely) browsers were not MITM’d. cortesoft 11 hours ago We would still know if certs were issued, though, which is the thing we want to check 13 replies → tptacek 11 hours ago I'm not following. Browser or no browser, every cert eMudhra issues has to generate an SCT. 13 replies →
cortesoft 11 hours ago We would still know if certs were issued, though, which is the thing we want to check 13 replies →
tptacek 11 hours ago I'm not following. Browser or no browser, every cert eMudhra issues has to generate an SCT. 13 replies →
That’s why I’m talking about it purely in the context of incident response/forensics.
You claimed CT would “definitive”ly prove whether it has or has not been exploited, which is false.
The lack of CT entries only proves that (most likely) browsers were not MITM’d.
We would still know if certs were issued, though, which is the thing we want to check
13 replies →
I'm not following. Browser or no browser, every cert eMudhra issues has to generate an SCT.
13 replies →
CT is enforced in Android 17 by default.