On 6 October 2026 Google said that attackers had compromised three country-code domain registries (.gh, .sl, .as), changed DNS records and obtained HTTPS certificates for domains that were not theirs, several of Google's among them. Chrome blocked the ones Google found, and Google writes that Chrome's measures do not "reliably protect non-Chrome users".
A connected device is a non-Chrome user. Four questions about it:
- Whom does it trust? A full public root list compiled into the firmware means more than a hundred authorities can vouch for your server.
- Does it check revocation? Some embedded TLS libraries test a revocation list only if your own code hands them one.
- Can you change the trust list in the field, through an update whose signature does not depend on TLS?
- What registry does the device's server name depend on? .io and .ai are country codes too.
The note, with sources and a drill for the bench: https://newlinebreak.com/notes/your-device-is-not-a-browser/
Source: r/u/newlinebreak · by /u/newlinebreak