logoalt Hacker News

Scott_Helme_ • today at 3:45 PM • 0 replies • view on HN

For a scenario like this it doesn't help a given client what % of the ecosystem does SCT validation or not, all that matters is whether that client does it.

I agree that more SCT validation across the ecosystem reduces the value of a mis-issued certificate to an attacker, but a lot of value still remains.

If 90% of clients did SCT validation, an attacker can still succeed against the 10% that don't, there's no herd immunity.