Re: [TLS] access_administratively_disabled v2

[Mateusz Jończyk <[e-mail]>]

W dniu 04.01.2018 o 16:00, Salz, Rich pisze:
>
>>    Yes, at least in corporate environments, parental control solutions, etc.
>     This will give a more understandable message to the user.
>
>
> But as others have pointed out, the alert is not signed by the target origin.
> So anyone along the path can inject this alert.
Yup, just as anyone along the path can block the website.
> So browsers cannot trust it,
> and they certainly cannot display any possible text associated with it.
In the version being discussed there is no associated text.
>
> How can you distinguish valid and proper use, from not valid and improper use
> including DoS?
Any intermediary (ISP, etc.) can block a website and this way cause a DoS. TLS
changes nothing in this regard.
This solution only makes it obvious that the DoS is introduced intentionally.

> Without that algorithm specified, I doubt any browser
> would implement this.  (And IMO I doubt they will do so anyway.)
>
In the version being discussed it is just another error value.
I think browsers would implement it just like they will implement access_denied.

Greetings,
Mateusz Jończyk