alt Hacker NewsI wouldn’t consider it “solved” because most organizations and people don’t actually check the log.
And a malicious actor can abuse this fact.
I wouldn’t consider it “solved” because most organizations and people don’t actually check the log.
And a malicious actor can abuse this fact.
Having Chrome/Firefox asynchronously check the CT log 0.1% of the time would probably be enough to solve that.
CT logging is mandatory, and even a single missing cert is probably going to be an existential threat to any CA.
The fact that someone is checking is already enough of a deterrent to prevent large-scale attacks. And if you're worried about spearphishing-via-MitM, you should probably stick to Tor.