[websec] User interactivity requirements

[Ryan Sleevi <[e-mail]>]

>From someone who sent directly to the editors, and thus I've omitted their
address/name on the assumption of privacy.

In section "2.6. Validating Pinned Connections" there is written:
>    When a UA connects to a Pinned Host, if the TLS connection has
>    errors, the UA MUST terminate the connection without allowing the
>    user to proceed anyway.  (This behavior is the same as that required
>    by [RFC6797].)
> I think that "(This behavior is the same as that required by [RFC6797].)"
> is misleading, because RFC6797 states that its section 12 (which contains
> "12.1. No User Recourse") is non-normative.
> http://tools.ietf.org/html/rfc6797#section-12


Indeed, this is an oversight, and one that's arguably in conceptual
conflict with the paragraph that follows, which describes Pin Validation as
a SHOULD.

That is, one can imagine that a TLS connection that is being actively
MITM'd by a locally-installed trust anchor MAY induce other TLS errors. As
the UA will not be performing pin validation, it's not clear that the UA
should also be inheriting the requirement for non-procession.

That is, HSTS DOES have a normative requirement on termination (see
http://tools.ietf.org/html/rfc6797#section-8.4 ), which HPKP should also
have, but whether or not a user can proceed is non-normative and up to
implementations (with a general recommendation that the user should not be
permitted to proceed)