Re: VeriSign feedback/comments on STS -06 from Michal Zalewski on 2010-05-17 (public-web-security@w3.org from May 2010)

From: Michal Zalewski <lcamtuf@coredump.cx>
Date: Mon, 17 May 2010 16:17:25 -0700
To: Henrik Nordström <henrik@henriknordstrom.net>
Cc: "public-web-security@w3.org" <public-web-security@w3.org>
Message-ID: <AANLkTilNedHNiNaQx4g467BhkOibowjUK7lRT-x1oJqD@mail.gmail.com>

>> This would make it difficult to enroll (requiring changing all certs).
> Which is something you do anyway fairly frequently (every year or so)

...compared to the ability to toggle a HTTP header in a couple
minutes, for free (and roll back if things go wrong).

/mz

Received on Monday, 17 May 2010 23:18:01 UTC