<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 24, 2017, at 12:56 PM, Eric Mill <<a href="mailto:eric@konklone.com" class="">eric@konklone.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><br class="Apple-interchange-newline"><br style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class="gmail_quote" style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">On Fri, Feb 24, 2017 at 12:11 PM,<span class="Apple-converted-space"> </span><a href="mailto:philliph@comodo.com" class="">philliph@comodo.com</a><span dir="ltr" class=""><<a href="mailto:philliph@comodo.com" target="_blank" class="">philliph@comodo.com</a>></span><span class="Apple-converted-space"> </span>wrote:<br class=""><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;"><div style="word-wrap: break-word;" class=""><br class=""><div class=""><blockquote type="cite" class=""><span class="gmail-"><div class="">On Feb 24, 2017, at 11:38 AM, Eric Mill <<a href="mailto:eric@konklone.com" target="_blank" class="">eric@konklone.com</a>> wrote:</div></span><div class=""><br style="font-family: helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;" class=""><div class="gmail_quote" style="font-family: helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;"><span class="gmail-">On Fri, Feb 24, 2017 at 10:46 AM,<span class="gmail-m_8727930381780157936Apple-converted-space"> </span><a href="mailto:philliph@comodo.com" target="_blank" class="">philliph@comodo.com</a><span dir="ltr" class=""><<a href="mailto:philliph@comodo.com" target="_blank" class="">philli<wbr class="">ph@comodo.com</a>></span><span class="gmail-m_8727930381780157936Apple-converted-space"> </span>wrote:<br class=""></span><span class="gmail-"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;"><div style="word-wrap: break-word;" class=""><span class=""><div class=""><br class=""></div></span><div class="">You are misrepresenting what I am saying. Do not put words in my mouth again. You do not speak for me. Only I speak for me.</div><div class=""><br class=""></div><div class="">Is that totally clear?</div></div></blockquote><div class=""><br class=""></div><div class="">It's clear, but not relevant. As best as I can tell, it is an accurate representation of what you said, and nothing in the rest of your message indicated otherwise.</div></span></div></div></blockquote><div class=""><br class=""></div><div class="">You are not me, you will not speak for me. not now, not ever.</div><div class=""><br class=""></div><div class="">Your interpretation was wrong.</div><div class=""><br class=""></div><div class="">The White House is looking for a new press spokesperson I hear.</div></div></div></blockquote><div class=""><br class=""></div><div class="">Consider explaining why the interpretation was wrong, as you've yet to contradict it. Again, you said "Things have to break before some people will act. Which is why I consider the proposal to further reduce validity intervals to provide more procrastination time positively harmful.”</div></div></div></blockquote><div><br class=""></div><div>As we all know bad security can be worse than no security.</div><div><br class=""></div><div>What worries me is that the proposed change that will do nothing to improve security will be a substitute for action that would. And the activities of its proponents here does nothing but re-affirm that belief.</div><div><br class=""></div><div>The central issue here is that some people do not want to follow the PKIX spec and support revocation. So they are using a proposal to reduce the vulnerability window from 825 days to 398 to avoid talking about the fact that it should be 1 day.</div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class="gmail_quote" style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;"><div style="word-wrap: break-word;" class=""><div class=""><span class="gmail-"><blockquote type="cite" class=""><div class="gmail_quote" style="font-family: helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;"><div class="">Expiration will remove a compromised certificate from being used in an attack, whether or not any human is aware of the compromise.</div></div></blockquote><div class=""><br class=""></div></span><div class="">But will not prevent the malefactor being issued a new one. Because in your attack scenario, no CA would have reason not to re-issue.</div><div class=""><br class=""></div><div class="">It is very easy to devise attack scenarios in which a failure occurs. But they have no real significance unless you can show that your proposed course of action results in a different outcome.</div><div class=""><br class=""></div><div class="">This scenario does not.</div></div></div></blockquote><div class=""><br class=""></div><div class="">If all you care about is getting phishing domains revoked by CAs, sure, expiration doesn't help with that. That's not the only kind of attack that exists, and the question of whether CAs should be required to revoke phishing certificates is a very different discussion that shouldn't be entangled with whether or not reducing certificate lifetimes improves security.</div><div class=""><br class=""></div><div class="">Again, have you looked at the full range of the relying party ecosystem and measured support for expiration vs revocation? That's not to mention the gap in understanding of expiration vs revocation among the slice of the technical community that makes security/engineering decisions in various libraries and applications. The difference in complexity of the two features is enormous.</div></div><div class="gmail_signature" style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""></div></div></div></div></div></div></div></blockquote><br class=""></div><div>Phishing domains are not the only problem that exist. But last night I was reading a research paper from an employee of a well known browser provider that seemed to suggest that the number of currently valid certificates issued by one CA for one phishing target (PayPal) was rather higher than the total number of mis-issued certificates from all CA compromises ever, DigiNotar included.</div><div><br class=""></div><div>If you want to make an argument based on evidence, then introduce some evidence. To assert that another person is arguing from ignorance and then provide no evidence to support your claim is unhelpful.</div><div><br class=""></div><div><br class=""></div><div><br class=""></div><div><br class=""></div><br class=""></body></html>