IETF Logo Mail Archive

Re: [websec] draft-ietf-websec-key-pinning

Tom Ritter <tom@ritter.vg> Tue, 26 August 2014 02:06 UTC

Return-Path: <tom@ritter.vg>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E52BD1A067A for <websec@ietfa.amsl.com>; Mon, 25 Aug 2014 19:06:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.379
X-Spam-Level:
X-Spam-Status: No, score=-1.379 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9gRt-mqOhfeK for <websec@ietfa.amsl.com>; Mon, 25 Aug 2014 19:06:15 -0700 (PDT)
Received: from mail-ig0-x229.google.com (mail-ig0-x229.google.com [IPv6:2607:f8b0:4001:c05::229]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D2051A0678 for <websec@ietf.org>; Mon, 25 Aug 2014 19:06:14 -0700 (PDT)
Received: by mail-ig0-f169.google.com with SMTP id r2so5059304igi.2 for <websec@ietf.org>; Mon, 25 Aug 2014 19:06:14 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ritter.vg; s=vg; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=+K1ZLDEno7SbCMJXTFZQkGqYk9ffnhjp45QsexEwZhQ=; b=ODPmAC5uO+xhKp41qGi3sQSQWXudwDXxYwlty2El4Y3yd0JYRWoh7F9MWyaQXXq0jq PsnNk8nPNjY6oz5XdsLWFG4IZa50qJnu4ajYfKuJCAqTSdCpplZUxZ2EX25fh3eKd2A2 +Hb3CvUagh0jK87YSe8FnNyx1A9R6b2AD42T4=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=+K1ZLDEno7SbCMJXTFZQkGqYk9ffnhjp45QsexEwZhQ=; b=c7Q3xYZyFxQv85w2wsJfY0CsgbDQvpSgwxRmeuWJd1We2z6SVay3CrKCdWoTjLqzth /sKuP6TqH5CmqJFFC9wB87KymokBEJDDQQNHrCi2X/FAtalGKGdVtxwzQCkUKqm48zm+ 2PyKwD3E0ta5fMq3zGLlxwc6xxLxjcR+Ly7vKdKhrbCL6IOENkmAs5biQ9fDAdekdus9 SYaGwDEuBwQiKlMYjb/W1a72oJB7tDhzS/gb4O8U86mAdWDQ8OmgSu70WgmEBXjXb/wS xQh7r/7uuVkGcuzZEHblogRwss1TCdfcirbQ26mqHUAxC9i38uHAodydzzXzzUTK7Lbn eoBg==
X-Gm-Message-State: ALoCoQl6ERQiocIcZgHzz85C6UlTQV4kHStodrdHOoznsSlaIYFNB/p+7Qx8S1scD7eyodc9U2LF
X-Received: by 10.50.111.80 with SMTP id ig16mr19287148igb.43.1409018774006; Mon, 25 Aug 2014 19:06:14 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.107.10.104 with HTTP; Mon, 25 Aug 2014 19:05:53 -0700 (PDT)
In-Reply-To: <BAY169-DS45F1C5036AB09CA44D0BC7AEDF0@phx.gbl>
References: <BAY169-DS62B5941BF0A9024964BB0AEEE0@phx.gbl> <CACvaWvYHAmpX0f9_m-sckhWz9tcyWA-sxVR4vP-A5UcAQmnYXA@mail.gmail.com> <BAY169-DS45F1C5036AB09CA44D0BC7AEDF0@phx.gbl>
From: Tom Ritter <tom@ritter.vg>
Date: Mon, 25 Aug 2014 21:05:53 -0500
Message-ID: <CA+cU71k-pLD315dzfd_c74QM51c7V2VQkZ26PiXUTqntmESD=A@mail.gmail.com>
To: Eric Lawrence <ericlaw1979@hotmail.com>
Content-Type: text/plain; charset="ISO-8859-1"
Archived-At: http://mailarchive.ietf.org/arch/msg/websec/x6gUthkBd-hfOJ8l9QHiM5XAu84
Cc: draft-ietf-websec-key-pinning@tools.ietf.org, IETF WebSec WG <websec@ietf.org>, Ryan Sleevi <sleevi@google.com>
Subject: Re: [websec] draft-ietf-websec-key-pinning
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec/>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Aug 2014 02:06:16 -0000

On 25 August 2014 13:07, Eric Lawrence <ericlaw1979@hotmail.com> wrote:
>> No, PKP-RO is not meant to be cached. In this respect, it behaves similar
>> to Content-Security-Policy's reporting mechanism.
>
> Ah, interesting. I'm curious why not? Is there no use-case for allowing
> "report-only" pins to be persisted?

I think there definitely are, and I and most organizations I advise
would like that option.

-tom

v2.23.0 | Report a Bug | By Email