Re: [websec] DNS publication of HSTS and PKP header data using CAA

["Ryan Sleevi" <[e-mail]>]

On Wed, April 8, 2015 3:18 pm, Jeffrey Walton wrote:
>  This is obviously predicated on an online app and DNS. Is there any
>  interest in Installable Web Apps delivered over a trusted distribution
>  channel?

That's a question for the W3C, not the IETF.

>  Installable Web Apps are simply web apps with a manifest that are
>  packaged and installed like more traditional apps. They still use the
>  same technologies, like HTML, CSS and JavaScript. The trusted
>  distribution channel ensures the app is not tampered during delivery.
>  The class of app is supported by both Firefox and Chrome.

The summary doesn't match what is supported, but that's a question for the
W3C.

>  In the case of installable apps, the information like HSTS and HPKP
>  can be placed in the app manifest. Even better, standards like HPKP
>  won't need to provide the override because its confused about which
>  pinset is the right one to use. Because the HSTS and HPKP information
>  was in the manifest during delivery, there will be no question about
>  which policy or key to use.

By "the override", I presume you mean "the ability for a duly authorized
user with administrative access over the machine they own to set policies
for the applications they install", which you've objected to in the past,
in which case, there's no reason at all to assume that the respect for a
user's wishes over that of the developer's would somehow be inverted.

The W3C is quite nice in spelling this out -
http://www.w3.org/TR/html-design-principles/#priority-of-constituencies


In either event, it sounds very much like a question for the W3C and the
format application manifests take and are extended, and nothing to do with
this WG.