Re: [websec] Decouple HSTS's two orthogonal effects?

[Adam Barth <[e-mail]>]

On Tue, Mar 29, 2011 at 3:25 PM, Daniel Kahn Gillmor
<[e-mail]> wrote:
> On 03/29/2011 04:58 PM, Adam Barth wrote:
>> There's no coupling between HSTS and the particular algorithm a UA
>> uses to verify certificates.  The UA is free to use whatever
>> verification mechanism it desires.  You can remove whatever CAs you
>> consider sloppy from the list of trusted certificate authorities and
>> add in whatever other verification mechanism you like.
>>
>> For example, if/when certificate verification through DNSSEC becomes
>> widespread, we won't need to change anything about the HSTS spec.  Of
>> course, we'll need to change our implementations, but that's true
>> regardless of what the HSTS spec says.
>
> I hear what you're saying; however, i'm unaware of any HSTS-compliant
> User Agent that implements anything but the standard weakest-link X.509
> certificate pool of trusted authorities.
>
> Perhaps an explicit mention that says HSTS is not intended to be
> incompatible with alternative certificate verification mechanisms would
> provide useful guidance to browser vendors?

I don't think we need that guidance, but thanks.

Adam