On Mon, Oct 28, 2013 at 12:54 PM, Jeremy Rowley <[email protected]> wrote: > Depends on what you mean by "matter". I'd say it matters to a FireFox user > to know whether a site has the potential for a MITM attack even if the MITM > attack isn't currently underway.
Why? Let's say we had a system that could perfectly prevent every attack, but it could only do so at the exact instant that an attack took place. Would you consider that to be an unacceptable alternative to the current system? Or, are you just saying that, given the flaws in the current system, it is better to be proactive about revocation checking. > You said "No harm, no foul", but that > assumes no harm only encompasses immediate harm instead of both immediate > and potential harm. There is harm by allowing a revoked certificate to > continue to be trusted even if that harm is not immediately recognized. There's always some potential for a MITM attack even if we did hard-fail revocation checking on every connection. So, the question isn't whether there's potential for a MitM attack, but whether there's potential for a MitM attack that revocation checking would actually be able to prevent. That means we need to consider how realistic it is for such an attack to take place, and how likely it is that a revocation check would prevent that attack. I hope you can understand how a software engineer would have trouble arguing in favor of such an expensive feature as CRL fetching (or even OCSP fetching) without a valid argument in favor of doing it. Right now we're lacking valid arguments for doing it. Cheers, Brian _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
