answered in adam's blog; see the paragraph beginning with

   Everyone does soft-fail

I guess that's true when a hard-fail causes the connection to be refused immediately by the client with no user input. In that case a DoS on the OCSP servers breaks things badly.

However what I meant to suggest is a third option. Something like hard-fail with a latch. The client should opt to fail but give the user the choice to proceed.

This would seem more desirable than the current soft-fail implementations when seem to be entirely silent to the end user.

Users make terrible security decisions. ~95% of users click through certificate failure pages, ~99% of users don't notice if a website transparently downgrades to HTTP. Delegating the choice, which would be borderline impossible to explain to the user is another way of saying 'Always say yes to proceed'.

That is simply not true. Firefox does hard-fail with the default settings.

I'm sure it doesn't. I just checked Options -> Advanced -> Certificates -> Revocation, and it's not checked by default.

And I'm sure you are wrong. I only see a Validation option(not Revocation), which has 2 more options on how to check OCSP, and those are both checked using the defaults. The correct path on my OS is Edit -> Preferences -> Advanced -> Certificates -> Validation -> OCSP options(both checked)

I think you've altered your settings at some point. It's not the default.

You would see a huge influx of bugzilla entries of "Firefox is broken" if hard fail was the default.

edit: the checkbox in the validation subdialog (ocsp.xul) is tied to security.OCSP.require, which is set here with a default of false in the Firefox source: http://dxr.mozilla.org/mozilla-central/source/netwerk/base/p...

> I think you've altered your settings at some point. It's not the default.

I think some extension or some other thing changed them for me. I don't remember ever opening the OCSP dialog until now :/

I just checked, and the checkbox for enabling hard-fail is unchecked with my default Firefox settings.