On 04/09/2011 10:32 PM, From Adam Barth:
Yes. Certificate (or CA) pinning in HSTS is an agreement between a
web site and a browser.
Excellent! Even though I assume that this still prevents only a
particular failure and probably should never be a substitute or shifting
of responsibilities by the CAs.
But as long that this is voluntarily and optionally for those
seeking/needing/wanting an added break, I think that's nice to have.
Regards
Signer: Eddy Nigg, COO/CTO
StartCom Ltd. <http://www.startcom.org>
XMPP: [email protected] <xmpp:[email protected]>
Blog: Join the Revolution! <http://blog.startcom.org>
Twitter: Follow Me <http://twitter.com/eddy_nigg>
_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security
