Re: [websec] #59: Is the interaction between pre-loaded pins and dynamic pins clear?

[Trevor Perrin <[e-mail]>]

On Sun, Aug 11, 2013 at 1:55 PM, websec issue tracker
<[e-mail]> wrote:
> #59: Is the interaction between pre-loaded pins and dynamic pins clear?

Still needs discussion, in particular:

 * Preloaded pin stores will be periodically updated, which means
browsers will need to handle "backdated" pins, i.e. pins that are
received *after* other HPKP observations but have an "Effective Pin
Date" which is earlier.  To handle these in accordance with 2.7
requires browsers to remember "un-pinning" observations (expired pins,
max-age=0, or nonexistent HPKP headers).  This is sufficiently complex
that the spec needs some treatment of it.

 * 2.7 mandates that the most recent observation from any source MUST
take priority.  Browsers would not be allowed to implement other
priority rules, such as prioritizing one source over another,
prioritizing fail-open or fail-closed behavior, or anything else.  I
believe this is overly restrictive.  Some browsers might prefer
different policies, e.g. simpler policies that don't require tracking
"un-pinning" data.

When I brought these points up earlier, the two responses were
supportive of loosening the rules in 2.7.  I hadn't responded to
Yoav's latest query because I'm overloaded with HPKP discussion, and
assumed everyone else was too.

So I suggest we keep this open, and revisit once other discussions quiet down.


Trevor