IETF Logo Mail Archive

Re: [websec] Consensus call: Issue #57 (max-max-age)

Trevor Perrin <trevp@trevp.net> Tue, 04 June 2013 17:17 UTC

Return-Path: <trevp@trevp.net>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 939D021F9B38 for <websec@ietfa.amsl.com>; Tue, 4 Jun 2013 10:17:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.48
X-Spam-Level:
X-Spam-Status: No, score=0.48 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_PBL=0.905, RDNS_NONE=0.1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IrtmSYmG4wIE for <websec@ietfa.amsl.com>; Tue, 4 Jun 2013 10:17:32 -0700 (PDT)
Received: from mail-wi0-x236.google.com (mail-wi0-x236.google.com [IPv6:2a00:1450:400c:c05::236]) by ietfa.amsl.com (Postfix) with ESMTP id F02BB21F9704 for <websec@ietf.org>; Tue, 4 Jun 2013 08:21:15 -0700 (PDT)
Received: by mail-wi0-f182.google.com with SMTP id c10so327452wiw.15 for <websec@ietf.org>; Tue, 04 Jun 2013 08:21:15 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-originating-ip:in-reply-to:references:date :message-id:subject:from:to:cc:content-type:x-gm-message-state; bh=fcPYbhDNQnm0f21em/5iHfs41R3qbqeaRDQuemclWYk=; b=A/PQTaWdPnNc+D6/R+oTzit+onw7DSfRIJA60cQqS596Akbhjfc8biArbjjijnB2Ps 6K6O54zeRRVgkSv6g/rUEtqSSVwutkIeLBuZJu4XNjQB8QiryUvAfdyobSYxYfM8VDJl TPXDgqazPKixOtODFanfS/VXgjwI3wXNrQX0go497JtuIyvC2ZP0/goAjgzud1Iko2WY h5zYHWiLlhUUyTCgXsn2kpfIjn79HlW0oDd5puQlvhaKaupqB60PhaDu0w1C9601Dciv iL5zEh1fapUMZm+MfRMODaApPC0As60+suWi/4ahz/hKdDGURB0/+D7E9PC0k0vJrZvU YBVQ==
MIME-Version: 1.0
X-Received: by 10.194.59.72 with SMTP id x8mr24439799wjq.49.1370359275130; Tue, 04 Jun 2013 08:21:15 -0700 (PDT)
Received: by 10.217.110.129 with HTTP; Tue, 4 Jun 2013 08:21:14 -0700 (PDT)
X-Originating-IP: [166.147.108.64]
In-Reply-To: <51ADBBA3.3000105@gondrom.org>
References: <43C5DE99-43EB-42FC-8F61-24F9A9429FD1@checkpoint.com> <CA+cU71=Q_QkHqiQ95AZgw8Bi7U_mgCi4icMypwFUp1C6i=apUA@mail.gmail.com> <518EE510.9060600@it.aoyama.ac.jp> <8450797E-818C-445C-ABD2-1B8F9AE1DBB9@checkpoint.com> <5194918A.7030300@gondrom.org> <CAGZ8ZG0SWZD9e-NP2RhQMQ-=F5JUCCytF2NYTdWH7u13hhBqqQ@mail.gmail.com> <519D3254.1040508@gondrom.org> <CAGZ8ZG15ZbjfDcu+bpetvfZxKG1ycW9t1AGuQ+A5cfpfkUAfnw@mail.gmail.com> <CAOuvq237_B1h6mBryP3UHh=auqtUhs93-_oKMSsHOjqSX977bQ@mail.gmail.com> <51A49A5C.5080002@gondrom.org> <CAOuvq20_zACXraV9iN6mUbDwML8GkSCwh9w2Cuow818YOLL-Sw@mail.gmail.com> <7AD36561-65B4-448C-A371-907B12B75AF1@checkpoint.com> <CAOuvq23a0BiO5pGDPLLvHY0bZ0JvVrFb7Aq-nGDoBQS_S8HFDw@mail.gmail.com> <584386D2-223C-4B6F-89BA-78769113D293@checkpoint.com> <CAGZ8ZG3ktYcJutAH19qW+=EP8oopq=XCTZ_td3Gyw2o2mMvzNA@mail.gmail.com> <51ADBBA3.3000105@gondrom.org>
Date: Tue, 04 Jun 2013 08:21:14 -0700
Message-ID: <CAGZ8ZG0M_928wvLNT8Ess8xS+A1rVh-m-8mikE7htdUvP7V-Pg@mail.gmail.com>
From: Trevor Perrin <trevp@trevp.net>
To: Tobias Gondrom <tobias.gondrom@gondrom.org>
Content-Type: multipart/alternative; boundary="047d7ba97308cf20db04de55a111"
X-Gm-Message-State: ALoCoQmpgj+bczMIrvxULTljbKYwQrtovo+/fAN9A5fslQVtmUQz+kOPqCcnAk8VI6/NXrsePxdY
Cc: IETF WebSec WG <websec@ietf.org>
Subject: Re: [websec] Consensus call: Issue #57 (max-max-age)
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 04 Jun 2013 17:17:37 -0000

On Tue, Jun 4, 2013 at 3:04 AM, Tobias Gondrom
<tobias.gondrom@gondrom.org>wrote:

>  Hi Trevor, hi all,
>
> (again no hats)
>
> actually regarding browser lookups of pin lists:
> I rather have the pins work unlimited and all the time even without pin
> lists.
>
> But your idea might in fact be a solution to enable the unlimited pin
> times.
> Instead of constantly distributing the list of pins, we could actually
> have browsers use whitelists of pins that have been "revoked" and where the
> browser is allowed to refresh. That could e.g. happen with a browser update.
>

Hi Tobias,

I agree there may need to be a mechanism for browser vendors (or other
third parties) to push out "pin revocation lists" that delete bad pins.

But if a bad pin occurs, there may be some latency before this list could
be updated.  And if a lot of bad pins occur, the list might not be large
enough to contain them all.

So I still think we want strong safeguards (such as max-age limits) to
reduce the incidence of bad pins as much as possible.


Trevor

v2.23.0 | Report a Bug | By Email