On Fri, Apr 7, 2017 at 9:27 AM, Bruce Morton < [email protected]> wrote:
> Sorry I missed that, but isn’t pinning high risk? I don’t think that any > CA would recommend pinning as it is unsupportable; we can’t do anything > when it fails. I think Subscribers should review pinning before deploying, > https://blog.qualys.com/ssllabs/2016/09/06/is-http-public-key-pinning-dead > . > For what it's worth, many of the complaints in that blog relate to CAs lack of disclosure related to their infrastructure - that's what creates the risks. So if CAs were more technically savvy, and worked to help understand their customers needs, it's very much viable. > I think the value of EV is that those certificates are not issued to > attackers. So it would be great if a Subscriber could state that their site > only uses EV and that the browser respected that statement. > And customers have that capability - if CAs, particularly their CA, is technically capable and/or transparent. The browser manufacturers have already give you that capability, if you chose to use it. > I also think that this statement might be better to be put in the HSTS > header. HSTS is low risk, EV is highly available and stating EV-only would > be applicable to most CAs. This allows the Subscriber to move from one CA > to another without bricking their site by pinning to a root or intermediate. > I disagree, and was pointing out how you can already accomplish this without requiring new features that accomplish the same as existing features =)
_______________________________________________ Public mailing list [email protected] https://cabforum.org/mailman/listinfo/public
