Bug 1758773: MITM in Russia

Re:Bug 1758773: MITM in Russia by randomhodler84 on Friday March 11, 2022 @07:01PM (#30647646)

It’s a lot more complex than you may realize. We have a transparency solution known as Certificate Transparency. For a “verisign” issued cert to be trusted in the browser, there must be an append only record of the cert stored in a blockchain. If Russia overrides a local trusted root, all bets are off an CTlog is not used. You can trust the CA because malicious issuance is a death sentence. And we have logs for all eternity.

[ Parent | on HN ]

Re:Bug 1758773: MITM in Russia by 0ldskool on Saturday March 12, 2022 @07:19PM (#30656529)

Hmm I had never heard of Certificate Transparency, looks like its a relatively newish tech added onto how SSL/TLS certs work. It seems only Google Chrome & Safari require SCT chains (not used by Firefox). Maybe I've never heard of it because I'm a Firefox user? You mentioned blockchain, does that mean there is a public blockchain for these Certs? I didn't see that mentioned anywhere but it does seem like blockchain features overlap with the desired features of "Certificate Transparency".

[ Parent | on HN ]

Re:Bug 1758773: MITM in Russia by aaomidi on Sunday March 13, 2022 @10:50AM (#30661690)

There is a blockchain ran by a bunch of interested third parties for CT, yes.

The block chain is different for each CT operator, it just allows you to validate the issued certs.

[ Parent | on HN ]