On 2011-09-08 10:57 AM, Daniel Veditz wrote:
On 9/6/11 11:07 AM, Devdatta Akhawe wrote:
Sure. But I think users would be very surprised to find that every
time they visit a SSL site, some server somewhere is noting down what
site they visited, and when.
Yes, OCSP supposedly traded off a little privacy for immediacy over
CRLs. Except that many OCSP deployments in practice just respond
based on the data in the CRL.
Peter Gutmann posted a draft OCSP replacement in the DigiNotar thread
over in s.policy:
> In response to my earlier "OCSP is unfixably broken, by design"
> comments, a couple of people have responded off-list with variants
> of "OK smartypants, how would you do it better?". In order to
> provide a general answer (and avoid fragmenting the discussion
> into lots of private-mail threads), I'll point to this:
>
> http://tools.ietf.org/id/draft-gutmann-cms-rtcs-01.txt
>
> This addresses all the problems I've pointed out in OCSP, as well
> as things OCSP never considered like performance issues (thus
> Verisign's security-breaking OCSP "optimisations"). It's been
> peer-reviewed and vetted, and I could have it re-posted in current
> draft format in a couple of days if there's any interest in finally
> switching validity-checking to proper whitelists (and fixing all of
> OCSP's other bugs).
I skimmed the spec and didn't see anything directly relating to user
privacy, but if we're thinking about revising OCSP for privacy's sake,
it might be easier to start from something like this.
zw
_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security
