News for hackers. Stuff that matters.
Re:Further improving digital certificate security by moxie on Sunday December 08, 2013 @01:29PM (#6870652)
CT requires all CAs to willingly participate. They are, obviously, less than willing:

https://groups.google.com/forum/#!msg/certificate-transparen...

(Symantec is VeriSign)

The efficacy of CT will largely hinge on whether Google can get CAs to participate. Even if they can, it'll be a long road (it already has been), and TACK is immediately deployable in the short term.

Re:Further improving digital certificate security by skybrian on Sunday December 08, 2013 @03:21PM (#6871208)
Is it necessary to get every cert? Getting the CAs to participate would be the best way, but it seems there are workarounds that will result in a large number of certs to be listed, though not all of them:

"Google is currently operating a Certificate Transparency log, and we are filling the log with certificates that we retrieve while crawling the web. We are also actively working on monitoring and auditing software."

http://www.certificate-transparency.org/faq

Re:Further improving digital certificate security by rmoriz on Sunday December 08, 2013 @03:17PM (#6871190)
Something like pinning for S/MIME would be great, too…
Re:Further improving digital certificate security by ars_technician on Sunday December 08, 2013 @03:56PM (#6871367)
It doesn't require all of them. They just need enough to reach a critical mass at which point they can start rejecting.

Also, a client can submit their cert to the log regardless of CA support. The only thing CA support is needed for is automated submissions.