Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

So, as mentioned in the first link, client audits via the browser would do absolutely nothing during an attack:

"None of CT’s proofs (audit or consistency proofs) will detect mis-issuance of a certificate by a rogue CA, not even if gossip of STHs (signed-tree-heads) successfully occurs [1]"

And that's for today's attacks. In the section before that paragraph, another attack is demonstrated that also cannot be prevented by CT's audit proofs.

[1] https://moderncrypto.org/mail-archive/messaging/2014/000873....



And the point is that logging intermediates only does not directly prevent the attacks but it is still useful.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: