Hacker News Reader

>why would they include a bad cert they issued in certificate transparency logs?

Because secure browsers like Chrome require certificate transparency for it to trust the cert.

Unfortunately there still exist insecure browsers like Firefox which leaves a percentage of the population vulnerable to bad certs that aren't logged.

View on HN

> Because secure browsers like Chrome require certificate transparency for it to trust the cert.

And if it was found out to be fraudulent? "Secure" Chrome would do f***all unless you're PayPal while "insecure" Firefox always checks if the certificate is still valid.

Since OCSP fails open and response stapling is still only deployed on a minority of servers, it doesn’t provide much of a guarantee…

How can Chrome be considered secure if its "security" entails the equivalent of giving a shell on the PC of all users to a shady corporation like Google?

Reply on news.ycombinator.com