Re: [therightkey] The Trouble with Certificate Transparency

[Nico Williams <[e-mail]>]

First, no protocol can really protect you from MITM attacks when you
can't have pre-shared key material a priori.

Second, CT helps primarily by increasing the risk of MITMing CAs (and
logs) getting caught.

Anything that increases that risk will tend to make the CAs (and logs)
less willing to act as or cooperate with MITMs.

Sure, targeted attacks might succeed, but they might fail (e.g., they
might be detected after the fact), with all the consequences that that
entails (at least reputational damage).

Now consider a world where we opportunistically encrypt (and
authenticate, where possible).  In such a world targeted attacks get
much harder: because the attacker might have to MITM non-targets'
connections in order to find the target's connections.  The risk to the
attacker then grows quite a bit (hard to quantify), and the attacker
then has to do much more work to reduce their risk.

All of the above is not nothing.  It's a lot.  It might be enough to
greatly improve security on the Internet all around.  IMO it will be.

Nico
--