No, don't enable revocation checking

Re:No, don't enable revocation checking by dwightgunning on Sunday April 20, 2014 @04:36AM (#7616258)

I guess that's true when a hard-fail causes the connection to be refused immediately by the client with no user input. In that case a DoS on the OCSP servers breaks things badly.

However what I meant to suggest is a third option. Something like hard-fail with a latch. The client should opt to fail but give the user the choice to proceed.

This would seem more desirable than the current soft-fail implementations when seem to be entirely silent to the end user.

[ Parent | on HN ]

Re:No, don't enable revocation checking by richardwhiuk on Sunday April 20, 2014 @10:43AM (#7616901)

Users make terrible security decisions. ~95% of users click through certificate failure pages, ~99% of users don't notice if a website transparently downgrades to HTTP. Delegating the choice, which would be borderline impossible to explain to the user is another way of saying 'Always say yes to proceed'.

[ Parent | on HN ]