News for hackers. Stuff that matters.

A comment on Revocation still doesn't work.

Re:Revocation still doesn't work by joshpeek on Wednesday April 30, 2014 @04:59PM (#7676404)
It seems like Langley and Gibson both agree that OCSP Must-Staple would resolve all this.

"If we want a scalable solution to the revocation problem then it's probably going to come in the form of short-lived certificates or something like OCSP Must Staple." - https://www.imperialviolet.org/2014/04/19/revchecking.html

"The case for “OCSP Must-Staple" - https://www.grc.com/revocation/commentary.htm

[ Parent | on HN ]
Re:Revocation still doesn't work by yuhong on Wednesday April 30, 2014 @08:29PM (#7677425)
Personally, I am for a hard fail OCSP option in HSTS or certificate plus OCSP stapling. Default to soft fail with a warning message for now. Remember captive portals can use OCSP stapling too.
[ Parent | on HN ]