| ▲ | Scott_Helme_ a day ago | |
For a scenario like this it doesn't help a given client what % of the ecosystem does SCT validation or not, all that matters is whether that client does it. I agree that more SCT validation across the ecosystem reduces the value of a mis-issued certificate to an attacker, but a lot of value still remains. If 90% of clients did SCT validation, an attacker can still succeed against the 10% that don't, there's no herd immunity. | ||