That’s why I’m talking about it purely in the context of incident response/forensics.
You claimed CT would “definitive”ly prove whether it has or has not been exploited, which is false.
The lack of CT entries only proves that (most likely) browsers were not MITM’d.
alt Hacker News
You claimed CT would “definitive”ly prove whether it has or has not been exploited, which is false.
The lack of CT entries only proves that (most likely) browsers were not MITM’d.