Comment by tptacek
19 hours ago
Right, but you don't have to wait for some hapless random browser to check; you can write your own monitor, and people do that.
19 hours ago
Right, but you don't have to wait for some hapless random browser to check; you can write your own monitor, and people do that.
I hold eMudhra's private key. I generate a cert signed by their intermediate on my box. eMudhra didn't issue the cert, so it is not sent to any CT logs, and I have no SCT to put in the cert.
Am I missing what you mean by monitor?
I think I might just be talking past you. If your point is "anyone with these broken eMudhra keys can attack users without caring about CT", that's totally true --- it's just that browser/no-browser doesn't factor into it. I'm really only on this subthread because of the notion that CT enforcement requires browsers.
Right, I think I'm with you that browser/no browser shouldn't be a factor. I think I'd like to hear from Rust and Go webpki people on whether we could help the ecosystem enforce CT.
My point is more that as a user of a high-level library like reqwest, I'd like to talk safer defaults when root CAs are in use
1 reply →