Re: [TLS] [pkix] Proposing CAA as PKIX Working Group Item

[Phillip Hallam-Baker <[e-mail]>]

sorry, that should have been, the previous year. CAA was developed in the
fall of 2010.

On Wed, Jun 8, 2011 at 8:56 AM, Phillip Hallam-Baker <[e-mail]>wrote:

> First off, I think that people need to stop using the -gate suffix. Just
> because a competitor decided that they would attempt to apply it does not
> mean it is justified. That is an old game and a rather silly one in our
> industry. The relevant cautionary text here being John 8:7.
>
> What differentiates companies in our industry is not whether they are
> breached, it is whether they give prompt, voluntary notice of breaches that
> occur or not. The market leaders in the CA industry have a track record of
> having done so.
>
>
> As for CAA being a response to the Iranian attack, Ben, Rob and I developed
> it a year earlier.
>
> The point of proposals like CAA is not whether they are 'necessary' or not,
> it is whether they mitigate risk. I have never seen a security control
> involving a human element that is guaranteed to be operated with 100%
> accuracy every time. So whenever there are humans involved I like to have
> strength in depth.
>
> There would be no problem here if browsers actually implemented revocation
> checking either. But we have had that in PKIX specs for 15 years and it
> still isn't deployed in hard fail mode. Which is rather sad when you
> consider that about 70% of the complexity of PKI comes from the need for
> revocation.
>



-- 
Website: http://hallambaker.com/