Re: [websec] Decouple HSTS's two orthogonal effects?

[Daniel Kahn Gillmor <[e-mail]>]

On 03/29/2011 04:58 PM, Adam Barth wrote:
> There's no coupling between HSTS and the particular algorithm a UA
> uses to verify certificates.  The UA is free to use whatever
> verification mechanism it desires.  You can remove whatever CAs you
> consider sloppy from the list of trusted certificate authorities and
> add in whatever other verification mechanism you like.
> 
> For example, if/when certificate verification through DNSSEC becomes
> widespread, we won't need to change anything about the HSTS spec.  Of
> course, we'll need to change our implementations, but that's true
> regardless of what the HSTS spec says.

I hear what you're saying; however, i'm unaware of any HSTS-compliant
User Agent that implements anything but the standard weakest-link X.509
certificate pool of trusted authorities.

Perhaps an explicit mention that says HSTS is not intended to be
incompatible with alternative certificate verification mechanisms would
provide useful guidance to browser vendors?

	--dkg