[cabfpub] [EXTERNAL] Brazilian bank DNS heist
sleevi at google.com
Fri Apr 7 07:16:32 MST 2017
On Fri, Apr 7, 2017 at 9:27 AM, Bruce Morton <
Bruce.Morton at entrustdatacard.com> wrote:
> Sorry I missed that, but isn’t pinning high risk? I don’t think that any
> CA would recommend pinning as it is unsupportable; we can’t do anything
> when it fails. I think Subscribers should review pinning before deploying,
For what it's worth, many of the complaints in that blog relate to CAs lack
of disclosure related to their infrastructure - that's what creates the
risks. So if CAs were more technically savvy, and worked to help understand
their customers needs, it's very much viable.
> I think the value of EV is that those certificates are not issued to
> attackers. So it would be great if a Subscriber could state that their site
> only uses EV and that the browser respected that statement.
And customers have that capability - if CAs, particularly their CA, is
technically capable and/or transparent. The browser manufacturers have
already give you that capability, if you chose to use it.
> I also think that this statement might be better to be put in the HSTS
> header. HSTS is low risk, EV is highly available and stating EV-only would
> be applicable to most CAs. This allows the Subscriber to move from one CA
> to another without bricking their site by pinning to a root or intermediate.
I disagree, and was pointing out how you can already accomplish this
without requiring new features that accomplish the same as existing
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Public