Re: How to log out of SDR?

2009-10-15 Thread Neil
Nelson B Bolyard wrote: By the way, I REALLY REALLY wish that the password manager would use that when you click the button to reveal the passwords, instead of doing what it does now, which forces you to re-enter the master password, even if you've JUST entered it. I think this is a

Re: How to log out of SDR?

2009-10-15 Thread Neil
Robert Relyea wrote: If you have no master password set, you have a token that doesn't have 'need login' set in it. NSS will treat such a token as always logged in. No matter how many times you log out, the token and it's keys are still available. What exactly are you seeing? What I'm

Re: Making OCSP soft fail smarter

2009-10-15 Thread Gervase Markham
On 13/10/09 16:18, Anders Rundgren wrote: IMO putting OCSP or CRLs in public SSL certificates was never a particularly good idea because the only likely case for a revocation is when a CA fails to validate a customer. That has happened but not often enough to motivate the building of new

Re: Making OCSP soft fail smarter

2009-10-15 Thread Gervase Markham
On 13/10/09 22:37, Robert Relyea wrote: It turns out that of all cases 2, 3, and 4, case 4 is the easiest (simply overload the requested OCSP server). Also, if you can do 2, and 3, you can always do 4 (You just drop the packet on the ground). So while an attacker may have lots of things he can

Re: Making OCSP soft fail smarter

2009-10-15 Thread Ian G
On 15/10/2009 15:21, Gervase Markham wrote: On 13/10/09 16:18, Anders Rundgren wrote: IMO putting OCSP or CRLs in public SSL certificates was never a particularly good idea because the only likely case for a revocation is when a CA fails to validate a customer. That has happened but not often

Re: Making OCSP soft fail smarter

2009-10-15 Thread Eddy Nigg
On 10/15/2009 03:57 PM, Ian G: On 15/10/2009 15:21, Gervase Markham wrote: On 13/10/09 16:18, Anders Rundgren wrote: IMO putting OCSP or CRLs in public SSL certificates was never a particularly good idea because the only likely case for a revocation is when a CA fails to validate a customer.

Re: Making OCSP soft fail smarter

2009-10-15 Thread Anders Rundgren
Eddy Nigg wrote: Which is obviously not correct. Most revocations happen due to loss and compromise of private keys, retirements, software bugs, misuse, but seldom due to validation failures. I would be surprised if a single public-TTP-issued server-certificate has ever been revoked due to loss