目录
前言
讲了证书透明度,通过audit增强认证。
一、before certificates
容易有网络攻击
- DNS isn’t very secure, can fake DNS information for gmail.com to browser
- network routers, routing system, WiFi not always very secure
二、certificates
2.1 basic certificate and CA scheme
通过https建立链接
- server sends certificate
- browser checks CA signature (using list of acceptable CA public keys)
- browser challenges server to prove it has private key
网络攻击gets hard
但是还不够好
- it’s not clear how to decide who owns a DNS name
- there are over 100 CAs in browsers’ lists
- not all of them