<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Plus, that still ignores the 10 day lifetime for OCSP. If you have
an even distribution of hits during that time, the time to revoke is
5 days. With Gerv's proposal, the time to revoke is only 2 days -
and it's a 100% revocation at that time.<br>
<br>
Maybe everyone hitting the site is unlikely for mom and pop shops,
but for someone like Google or Amazon (where people often visit
their page at least once every 10 days), a two day window is a
significant improvement. Considering the work required to deploy
short-lived certs, we probably don't need to worry about rapid
adoption by mom and pop sites.<br>
<br>
Jeremy<br>
<br>
<div class="moz-cite-prefix">On 10/24/2014 12:42 PM, Ryan Sleevi
wrote:<br>
</div>
<blockquote
cite="mid:CACvaWvYJgzjgkjQGL_S4cqb+hc4_S7zCoMN-O2F1xq774Q5vEA@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<p dir="ltr">Rich,</p>
<p dir="ltr">As has been explained in the past, with OCSP stapling
the 'attacker' can replay the gold response to all clients.</p>
<p dir="ltr">They really are the same security risk profile. </p>
<div class="gmail_quote">On Oct 24, 2014 11:37 AM, "Rich Smith"
<<a moz-do-not-send="true"
href="mailto:richard.smith@comodo.com">richard.smith@comodo.com</a>>
wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Only if
EVERY user who will hit the site after the certificate is<br>
revoked has already visited the site prior to revocation and
cached the<br>
Good response. Very unlikely, so a very shaky definition of
'better' IMO.<br>
<br>
On 10/24/2014 1:30 PM, Jeremy.Rowley wrote:<br>
> It's actually<br>
> better than OCSP as defined in the BRs since that has a
10 day validity<br>
> period.<br>
<br>
_______________________________________________<br>
Public mailing list<br>
<a moz-do-not-send="true" href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a moz-do-not-send="true"
href="https://cabforum.org/mailman/listinfo/public"
target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
</blockquote>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<br>
</body>
</html>