Re: TLS everywhere has a major flaw and needs refining to the page level.

2018-02-16 Thread Kevin Chadwick via dev-security-policy
On Fri, 16 Feb 2018 08:15:10 -0800 > Given this group focused on Mozilla, it is likely out of scope to > discuss Chromium design. I do suggest you look at > https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html > It seems reasonably clear the marking is per top level page

Re: TLS everywhere has a major flaw and needs refining to the page level.

2018-02-16 Thread Kevin Chadwick via dev-security-policy
On Thu, 15 Feb 2018 15:55:27 -0600 > I'm not sure this can be worked around. A setup where time is not > pulled from the network is abnormal now, and most people who have such > a system soon realize what the issue is. OpenNTP has a constraint system but considering NTP is a latent, insecure,

TLS everywhere has a major flaw and needs refining to the page level.

2018-02-15 Thread Kevin Chadwick via dev-security-policy
The cookies etc. should be SSL only. Particular pages enforced, sure. Enforcing TLS with HSTS sitewide means that users with failed bios/laptop batteries have to know to reset their clock or get used to bypassing SSL warnings or use out of date browsers to access sites. A fairly common problem,

Re: Guang Dong Certificate Authority (GDCA) root inclusion request

2016-11-15 Thread Kevin
On Tuesday, November 15, 2016 at 6:03:07 AM UTC-5, wangs...@gmail.com wrote: > 在 2016年11月15日星期二 UTC+8上午8:51:25,Kathleen Wilson写道: > > On Friday, October 28, 2016 at 7:29:56 AM UTC-7, wangs...@gmail.com wrote: > > > We have uploaded the lastest translantion of CP/CPS. > > > CP: