Re: [websec] Certificate Pinning via HSTS (.txt version)

Marsh Ray <> Tue, 13 September 2011 20:56 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 668D611E80ED for <>; Tue, 13 Sep 2011 13:56:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.574
X-Spam-Status: No, score=-2.574 tagged_above=-999 required=5 tests=[AWL=0.025, BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id dRB6EbPvfUFp for <>; Tue, 13 Sep 2011 13:56:09 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id D704111E80E5 for <>; Tue, 13 Sep 2011 13:56:09 -0700 (PDT)
Received: from ([]) by with esmtpa (Exim 4.72) (envelope-from <>) id 1R3a3c-000E2y-Pd; Tue, 13 Sep 2011 20:58:16 +0000
Received: from [] (localhost []) by (Postfix) with ESMTP id 91ED86067; Tue, 13 Sep 2011 20:58:14 +0000 (UTC)
X-Mail-Handler: MailHop Outbound by DynDNS
X-Report-Abuse-To: (see for abuse reporting information)
X-MHO-User: U2FsdGVkX19kD/C3gGqEZp3cLGwwRmq5WKc/hVmiyoQ=
Message-ID: <>
Date: Tue, 13 Sep 2011 15:58:16 -0500
From: Marsh Ray <>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv: Gecko/20110831 Thunderbird/3.1.13
MIME-Version: 1.0
To: Gervase Markham <>
References: <> <> <> <> <>
In-Reply-To: <>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Cc: IETF WebSec WG <>
Subject: Re: [websec] Certificate Pinning via HSTS (.txt version)
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 13 Sep 2011 20:56:10 -0000

On 09/13/2011 03:38 PM, Gervase Markham wrote:
> On 13/09/11 13:06, Marsh Ray wrote:
>> Or not, like the Dutch government, have the pull to convince Mozilla to
>> hesitate for a few days to revoke your pwned CA.
> That is rather unfair. You make it sound like they asked, and we
> complied. In truth, we relied on an assessment of the situation from
> GovCERT, the Dutch CERT - who have a decent reputation. When their
> assessment changed, we changed our position; whether they should have
> made their initial assessment the way they did is a good question, and
> one which concerned parties should ask them.
> It is certainly not an obvious truth, even more so in the heat of the
> moment, that a compromise of one part of a certificate hierarchy at a CA
> necessarily means that an entirely different one is also compromised. It
> may, it may not - that depends on the arrangement and interlinking or
> otherwise of the issuance systems.
> Anyway, regardless, the situation is more complex than your allegation
> of back-room influence.

Yes, I believe that and apologize if I characterized it unfairly.

That was just the impression I was left with reading the various 
explanations and interpretations of what was going on over those few 
days. I'm sure they weren't very accurate.

I can only imagine how hectic that process was for the parties involved 
and how complex a decision it must have been. Please understand that 
folks like me are looking it at all through a somewhat obscured window.

Sorry again.

- Marsh