undefined | Better HN

0 pointsakerl_2y ago0 comments

I'm not sure why you're so fixated on this idea of client systems monitoring CT logs.

Operators who host infrastructure can and should be monitoring issuance in CT logs for domains they operate, which will allow them to identify and react to any unexpected issuance for those domains.

0 comments

matthew92192y ago

In the attack DNSSec prevents, a client is compromised by a cert that doesn't appear in the CT logs, so infrastructure monitoring is irrelevant.

mjg592y ago

Most browsers will reject such a certificate. See https://googlechrome.github.io/CertificateTransparency/ct_po... for the policy Chrome imposes - my understanding is that Safari is broadly similar. Right now I don't think Firefox performs this validation, so this is possible if you know in advance that your target runs Firefox.

matthew92192y ago

That page explains that Chrome (which is best in class here - most IOT devices don't do any of this stuff) fails open:

> If the installed version of Chrome has not applied security updates and has been unable to obtain an updated CT log list from the Component Updater for 70 days or more, then CT enforcement will be disabled.

That means a global adversary need merely block the update channel to targeted devices and wait. How will a Smart TV behave?

1 more reply

j / k navigate · click thread line to collapse

0 pointsakerl_2y ago0 comments

I'm not sure why you're so fixated on this idea of client systems monitoring CT logs.

Operators who host infrastructure can and should be monitoring issuance in CT logs for domains they operate, which will allow them to identify and react to any unexpected issuance for those domains.

0 comments

matthew92192y ago

In the attack DNSSec prevents, a client is compromised by a cert that doesn't appear in the CT logs, so infrastructure monitoring is irrelevant.

mjg592y ago

matthew92192y ago

That page explains that Chrome (which is best in class here - most IOT devices don't do any of this stuff) fails open:

That means a global adversary need merely block the update channel to targeted devices and wait. How will a Smart TV behave?

1 more reply

j / k navigate · click thread line to collapse