IETF Logo Mail Archive

Re: [websec] draft-ietf-websec-key-pinning

Trevor Perrin <trevp@trevp.net> Fri, 05 September 2014 00:23 UTC

Return-Path: <trevp@trevp.net>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF3161A02E6 for <websec@ietfa.amsl.com>; Thu, 4 Sep 2014 17:23:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.978
X-Spam-Level:
X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2fIkf9VztwFx for <websec@ietfa.amsl.com>; Thu, 4 Sep 2014 17:23:32 -0700 (PDT)
Received: from mail-ie0-f170.google.com (mail-ie0-f170.google.com [209.85.223.170]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B07C1A02E0 for <websec@ietf.org>; Thu, 4 Sep 2014 17:23:32 -0700 (PDT)
Received: by mail-ie0-f170.google.com with SMTP id rl12so12830479iec.29 for <websec@ietf.org>; Thu, 04 Sep 2014 17:23:32 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=4jvxggc8ZWp+MSy2nV8oRTf+vAKR0Ss/+779je3k0C4=; b=ZgYX/LwZ2a6jMnGgMsWGUuBAHF4Cbzd1x31mUS48VRn2Qqpc2p4WEIG36YgaEUGFSV e9AFvfaYT+Wv+Zfg9vkRVsgbFz+dDKR3ZXUiOyDi2sHma4J0i+7CR9PbwNk+G0hQyxen Sp4oqu9fi/0BuDp1YRtS9E8qJmi/vmXfL7UouZMkKTMQXCG3kb73VElLg4xfk0yph2cg U7KcEzPnzcfldvy+Cf5V9M1DvuWPmeBGR4BI1nHpOWUbl0FFBlQtyqBZ6b4MAOyLqgQ5 TRD8BXV7pZGQCIcvVoTDI1/bSjOHwvJI8XFT4inRV2Iz6RgbvS2BWJvJKE1i9RNGNcwO RMCw==
X-Gm-Message-State: ALoCoQmEE6LzSiVtvhcBPEjORnIvDNG0ohD0VPvxljdMu3ibQtdRi6HuOKFTP5RuZ6TEAgI32tse
MIME-Version: 1.0
X-Received: by 10.42.227.10 with SMTP id iy10mr10185745icb.3.1409876611903; Thu, 04 Sep 2014 17:23:31 -0700 (PDT)
Received: by 10.107.133.67 with HTTP; Thu, 4 Sep 2014 17:23:31 -0700 (PDT)
X-Originating-IP: [66.212.64.164]
In-Reply-To: <CACvaWvYTFEN2bm3FAENZHKFyWAx1hmzB4-NN4VB3=x1PXSLRCw@mail.gmail.com>
References: <CACvaWvZNpAepBmWchLMirfPdxu4ed=vH1qwMppAjw1P9S+4quw@mail.gmail.com> <BAY169-DS311951F23960F4605A0CB0AEDA0@phx.gbl> <35F981DA-46C4-44D7-8582-25BF8BF1B31A@gmail.com> <BAY169-DS421419C50B5700132829BBAEDA0@phx.gbl> <CAGZ8ZG2S5XxyAkL=vr2VbCzKA2bfGk2FxK9RYGiBtMmG7UPraA@mail.gmail.com> <CACvaWvY3-6LMECBsobpgi-Uj2iUz0PNTsqZdiHUeuw-J9Tu_KQ@mail.gmail.com> <CAGZ8ZG1ohK0CH=ss+ynjpaedEGUTA_GwuSoueh2X2YQ7J-T=4w@mail.gmail.com> <CACvaWvYTFEN2bm3FAENZHKFyWAx1hmzB4-NN4VB3=x1PXSLRCw@mail.gmail.com>
Date: Thu, 04 Sep 2014 17:23:31 -0700
Message-ID: <CAGZ8ZG0w7HjA-iD1ah4SN249OZvDgOD9MC2RO68iMKCgX+eUSQ@mail.gmail.com>
From: Trevor Perrin <trevp@trevp.net>
To: Ryan Sleevi <sleevi@google.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/websec/-VjGBChL8-ZICjAYiJ4jfYQITGU
Cc: draft-ietf-websec-key-pinning <draft-ietf-websec-key-pinning@tools.ietf.org>, IETF WebSec WG <websec@ietf.org>
Subject: Re: [websec] draft-ietf-websec-key-pinning
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec/>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 05 Sep 2014 00:23:34 -0000

On Thu, Sep 4, 2014 at 5:06 PM, Ryan Sleevi <sleevi@google.com> wrote:
> I wish you would have raised this during WGLC, which would have benefited
> from the review and discussion now being paid.

I did raise this in response to the February Last Call, and multiple
times later.

There was some very light discussion which favored storing PKP-RO, the
draft was edited in the opposite direction, and it was sent on while
we were still discussing (with no additional WGLC).

But I agree that we're now having the discussion this issue deserves
(and which we never had earlier).


> That is, my understanding is that this is a bit like discovering a possible
> issue after you've shipped your gold master to 100K stores.

I don't see how we've shipped anything to anyone, so I don't see why
this is so painful to discuss.

But I'm just a random security nerd, the opinions of browsers and
websites are what matter here, so I'll defer to those.


Trevor

v2.46.0 | Report a Bug | By Email | System Status