<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I think an important point is who should bear the cost of minimizing the impact of a CA compromise. Even if CT is more expensive than pinning (which I doubt) and ignoring the fact that pinning and CT are NOT mutually exclusive, the cost for CT lies with the browsers and CAs while the cost for pinning is with the browser and server operator. Since the threat associated with a compromised or bad acting CA is directly related to our industry, the CA industry is best suited to bear the burden of fixing that problem, not the customers. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Jeremy<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>Ryan Sleevi<br><b>Sent:</b> Wednesday, December 18, 2013 2:44 PM<br><b>To:</b> Eddy Nigg (StartCom Ltd.)<br><b>Cc:</b> public@cabforum.org<br><b>Subject:</b> Re: [cabfpub] [cabfman] Improving the security of EV Certificates<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On Wed, Dec 18, 2013 at 1:39 PM, Eddy Nigg (StartCom Ltd.) <<a href="mailto:eddy_nigg@startcom.org" target="_blank">eddy_nigg@startcom.org</a>> wrote:<o:p></o:p></p><div><p class=MsoNormal><br>On 12/18/2013 11:32 PM, From Ryan Sleevi: <o:p></o:p></p><div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On Wed, Dec 18, 2013 at 1:23 PM, Eddy Nigg (StartCom Ltd.) <<a href="mailto:eddy_nigg@startcom.org" target="_blank">eddy_nigg@startcom.org</a>> wrote:<o:p></o:p></p><div><p class=MsoNormal><br>On 12/18/2013 10:14 PM, From Ryan Sleevi: <o:p></o:p></p><div><p>> How did you arrive at that sum? Pinning shouldn't really cost anything once the code is in the browsers. I also assume that code changes for CT wouldn't be any cheaper than that.<o:p></o:p></p></div><p>Pinning is NOT just a nob you turn. It carries huge operational risks to realize the preventative guarantees<o:p></o:p></p><p class=MsoNormal><br>Are we talking about the same thing here?<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Absolutely.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>If you haven't followed the IETF discussions about pinning, I absolutely encourage you to do so. <o:p></o:p></p></div></div></div></div></blockquote><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal>Sadly I don't have much time for IETF discussions, but...<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I can understand the volume of mail can be quite a bit, but I think it would be very helpful for the discussions to get some familiarity with the spec and the attendant issues if you do want to suggest it as a viable alternative to CT.<o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><p class=MsoNormal><br><br><br><o:p></o:p></p><div><div><div><div><p class=MsoNormal>The pinning draft itself is careful to spell out that there are non-trivial risks aplenty with pinning, BUT it can provide *preventative* mitigation.<o:p></o:p></p></div></div></div></div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal>WHAT? With pinning I understand to pin a particular certificate to a particular host name in the browser. Is this what you are talking about?<o:p></o:p></p></div></blockquote><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Yes. And it can be VERY risky, VERY hard to get right, and is a VERY costly mistake if you get wrong. That said, when the stars are aligned and the engineers are competant and the moon is shining upon you, it can actively prevent MITM, rather than just detect.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I'd be happy to discuss more with you, but pinning is absolutely something that even we at Google (proposers of it and authors of the current spec) are quick to point out is NOT a general solution for everyone and requires careful balance to choose whether the (risks of MITM) exceed (risks of bricking your entire site, with no one to dial up on a batphone to rescue you).<o:p></o:p></p></div></div></div></div></div></body></html>