Re:JPL Institutional Coding Standard for the C Programming L...
by Alupis on Sunday February 17, 2019 @08:21PM
(#19188028)
Looks valid on my machine (win10, chrome)
[ Parent
| on HN ]
Re:JPL Institutional Coding Standard for the C Programming L...
by segfaultbuserr on Sunday February 17, 2019 @11:13PM
(#19188597)
Because OCSP is not reliable. Yeah, SSL/TLS is still broken at large, can you believe it, by default, there is NO reliable way to revoke a certificate... If OCSP times out, it just times out, the browser simply ignores it and loads the page without warnings. Active attackers can just block the OCSP server before they can use a revoked certificate with leaked private key to launch a MITM attack.
This is why we need OCSP pinning and OCSP Must Staple. OCSP pinning makes the web server itself to delegate OCSP responses in-band, thus eliminates the need for clients to make an unreliable connection to a 3rd-party, improves both security and performance. OCSP Must Staple is a certificate attribute that forces the browser to enforce pinned OCSP checkings. This is also the reason that Let's Encrypt limits the certificate lifetime to 90 days.
Re:JPL Institutional Coding Standard for the C Programming L...
by cbsks on Sunday February 17, 2019 @08:45PM
(#19188108)
Safari on iOS does not trust the certificate