Re: [TLS] Update spec to match current practices for certificate chain order

[Dave Garrett <[e-mail]>]

On Friday, May 08, 2015 05:10:19 pm Ryan Sleevi wrote:
> On Fri, May 8, 2015 8:29 am, Dave Garrett wrote:
> >  Let me be clear: I don't fundamentally disagree with you.
> 
> While I have great respect for Martin, I do disagree and think he's
> fundamentally wrong here, for the reasons I already explained in my first
> message as to why what he's asking is not only *wrong*, but *unwise* and
> an unnecessary coupling of two intentionally-independent layers.

This is a two decade old set of security standards. If you want any strict
separation of layers, you're going to need to start from scratch. (which we're
hopefully doing soon with something QUIC based) Anything other than
acknowledging this current situation as a mess and doing what you can
where you can (e.g. HPKP) is not really practical.

Wise as it may be to try to keep things decoupled, it's not the current reality.

> And of course, coloring is the unquestionably wrong answer here from a
> usability study.

It's wrong just from a biological perspective, seeing how colorblindness of
various forms is not uncommon.


Dave