The CA's Role in Fighting Phishing and Malware

[joepie91]

@pfg

If an adversary can do that, they've also just ensured that a large majority of users won't be able to access the site at all.

While correct (and there have been a few cases of this happening), it still removes the choice of the user to ignore this warning (eg. if they know that this is the case) and still be assured of a secure connection, as the server can't have a valid TLS certificate. It'd still make the problem worse.

@pfg

Additionally, the default renewal schedule means you'll have at least 30 days to get your site off the list or find some other solution. If you're concerned about availability, you'll need to be monitoring your certificate lifetimes anyway, so this isn't really a new requirement.

Sites have historically been on Safe Browsing incorrectly for longer than that.