Hacker News Reader

Hence whoever maintains this list will be able to observe the traffic on a third party website.

No, that's not a valid conclusion. Browsers do not query log servers in real-time whenever they see a new certificate. Rather, servers send SCTs which are "a promise to add the certificate to the log within some time period"[1]. Comparatively speaking, think of this more like OCSP stapling as opposed to real-time OCSP queries.

Auditors and CT gossiping are responsible for ensuring that the log servers are not misbehaving.

[1]: http://www.certificate-transparency.org/how-ct-works

Correct. What might be interesting to add to this: you can't query Certificate Transparency servers by certificate. You can query them by index or by using an SCT hash, but if you want a definitive answer to "when was this certificate first logged?" you'll need to process the log completely. CT is not designed for live-checking of certificates, only for monitoring by domain owners.

That is an interesting point.

I suppose a client could act more like a monitor and download chunks of the log at a time, thereby hiding which site in the chunk they were interested in. That wouldn't be hugely efficient though.

Reply on news.ycombinator.com