No, don't enable revocation checking

Re:No, don't enable revocation checking by psykovsky on Sunday April 20, 2014 @05:50AM (#7616364)

That is simply not true. Firefox does hard-fail with the default settings.

[ Parent | on HN ]

Re:No, don't enable revocation checking by sp332 on Sunday April 20, 2014 @08:02AM (#7616547)

I'm sure it doesn't. I just checked Options -> Advanced -> Certificates -> Revocation, and it's not checked by default.

[ Parent | on HN ]

Re:No, don't enable revocation checking by psykovsky on Sunday April 20, 2014 @01:26PM (#7617621)

And I'm sure you are wrong. I only see a Validation option(not Revocation), which has 2 more options on how to check OCSP, and those are both checked using the defaults. The correct path on my OS is Edit -> Preferences -> Advanced -> Certificates -> Validation -> OCSP options(both checked)

[ Parent | on HN ]

Re:No, don't enable revocation checking by magicalist on Sunday April 20, 2014 @02:32PM (#7617915)

I think you've altered your settings at some point. It's not the default.

You would see a huge influx of bugzilla entries of "Firefox is broken" if hard fail was the default.

edit: the checkbox in the validation subdialog (ocsp.xul) is tied to security.OCSP.require, which is set here with a default of false in the Firefox source: http://dxr.mozilla.org/mozilla-central/source/netwerk/base/p...

[ Parent | on HN ]

Re:No, don't enable revocation checking by psykovsky on Monday April 21, 2014 @02:20PM (#7622660)

> I think you've altered your settings at some point. It's not the default.

I think some extension or some other thing changed them for me. I don't remember ever opening the OCSP dialog until now :/

[ Parent | on HN ]

Re:No, don't enable revocation checking by mpyne on Sunday April 20, 2014 @02:34PM (#7617926)

I just checked, and the checkbox for enabling hard-fail is unchecked with my default Firefox settings.

[ Parent | on HN ]