All articles tagged with #certificate transparency
Hackers compromised the .gh, .sl, and .as country code top-level domains to issue unauthorized TLS certificates for Google and other major brands. Google updated Chrome to block these forged credentials and advised domain owners to monitor certificate transparency logs, noting that browser-side fixes alone are insufficient for long-term protection.
Android 17 adds OS-wide Encrypted Client Hello (with default ECH GREASE) to hide visited domains from networks, introduces Local Network Protection, enforces Certificate Transparency by default, and allows carriers to disable 2G to reduce downgrade risks, with OkHttp integrating ECH support for developers—a broad zero-click privacy upgrade.
Android 17 adds four security-focused changes: per-app memory limits to curb memory-hogging apps, a default ACCESS_LOCAL_NETWORK permission to curb silent local-network scans, stricter rules on dynamic code loading to block post-install malware, and Certificate Transparency enabled by default to improve TLS verification (with opt-out options for apps or domains). These improvements aim to boost reliability, privacy, and trust with minimal impact on most apps.
Chrome is testing quantum-resistant HTTPS that uses Merkle-tree proofs, letting browsers verify certificates with tiny proofs instead of large data; a Tree Head signs millions of certs, keeping the data near 64 bytes. The plan for a broader rollout runs through 2027 with a parallel quantum-resistant trust store and mandatory certificate transparency, while traditional certificates remain as a safety net during the transition.