HNGlance

Top Best New Show

Revocation still doesn't work

https://www.imperialviolet.org/2014/04/29/revocationagain.html

by moonboots • 12 years ago

8 2 12 years ago

IM

imperialviolet.org

Related Stories

Loading related stories...

Comments

2

zurn• 12 years ago

Someone should set up a bet about what point in time more than 50% of MITM attempts with revoked (& Heartbleed-snarfed) certs will be caught by default configured browsers. "Never?"

This and lack of PFS are much bigger catastrophes than the OpenSSL debacle in itself.

(PFS: supported by TLS but disabled by almost everyone so all your old traffic is decryptable with heartbled cert).

yuhong• 12 years ago

Personally, I am for a hard fail OCSP option in HSTS or certificate plus OCSP stapling. Default to soft fail with a warning message for now. Remember captive portals can use OCSP stapling too.

Source preview

imperialviolet.org

HNGlance

© 2024-2026 HN Glance. Story content belongs to its original sources.

Privacy
Terms