W3C home > Mailing lists > Public > public-html@w3.org > September 2009

fyi: Strict Transport Security specification

From: =JeffH <Jeff.Hodges@KingsMountain.com>
Date: Sat, 19 Sep 2009 16:59:38 -0700
Message-ID: <4AB5706A.6070402@KingsMountain.com>
To: W3C HTML WG <public-html@w3.org>, whatwg@whatwg.org
Of possible interest to public-html@ & whatwg@ denizens...

[apologies for duplication]

------- Forwarded Message

Date:    Fri, 18 Sep 2009 18:00:50 -0700
From:    =JeffH <Jeff.Hodges@KingsMountain.com>
To:      public-webapps@w3.org
cc:      Jeff Hodges <jeff.hodges@paypal.com>,
	 Adam Barth <abarth@eecs.berkeley.edu>,
	 Collin Jackson <collin.jackson@sv.cmu.edu>
Subject: fyi: Strict Transport Security specification


We wish to bring the following draft specification to your attention..

      Strict Transport Security (STS)

It specifies a refined approach to that described by Jackson and Barth in..

      ForceHTTPS: Protecting High-Security Web Sites from Network Attacks

An experimental implementation of STS will be appearing in the Google Chrome
dev channel in the not-too-distant future..

      Google Chrome (dev channel)

Sid Stamm (of Mozilla) has a Firefox extension presently implementing
an earlier revision of this specification (a soon-to-appear v2.0 of
the extension will implement the present spec version)..

      Force-TLS 1.0.3

Sid also discusses this approach in this blog post..

      Locking up the valuables: Opt-in security with ForceTLS

We are interested in bringing this work to W3C WebApps Working Group as a
Recommendation-track specification. We are willing to license it under W3C
terms, we understand that it may change due to implementer or public feedback,
and that should it be of interest to other implementors, we're willing to
contribute to editorial and test suite efforts.

We're looking forward to the WebApps WG's feedback and comments.


PayPal InfoSec Team

Collin Jackson
Carnegie Mellon University

Adam Barth
University of California Berkeley

------- End of Forwarded Message
Received on Sunday, 20 September 2009 00:00:15 UTC

This archive was generated by hypermail 2.3.1 : Thursday, 29 October 2015 10:15:51 UTC