Hacker News Reader

Similarly to vaccines, part of the magic is that you don't need "all", you just need "most".

Right now CT support is rough for things outside of browsers; it's a pretty fair bet that if you pick up a command line tool or library, it is not checking SCTs, and that makes those workflows vulnerable. If we flipped that, and the average command line tool or library did validate by default, it would dramatically alter the risk calculus for attackers.

View on HN

For a scenario like this it doesn't help a given client what % of the ecosystem does SCT validation or not, all that matters is whether that client does it.

I agree that more SCT validation across the ecosystem reduces the value of a mis-issued certificate to an attacker, but a lot of value still remains.

If 90% of clients did SCT validation, an attacker can still succeed against the 10% that don't, there's no herd immunity.

Reply on news.ycombinator.com