Subject: [httpwg/http-extensions] Issues with server detection of attacks (#522)

From: HTTP issue updates <[email-masked]>
Date: Tue, 20 Mar 2018 16:32:17 +0000 (UTC)

ORIGIN removed the need for DNS lookups for servers, and IP connectivity.  Servers can look for bad DNS records or BGP hijacking to detect attacks without ORIGIN, but now those techniques don't work.  In particular, key compromise is a concern; misissuance is perhaps less of a concern.

Secondary certificates makes the entire situation worse.

In particular, it means that you can get a standalone certificate for the victim.  Previously, with coalescing, you would need to have a certificate that has both your own origin and the victim's origin, so that would be visible in a CT log.

Subcerts can help with this (they have much shorter lifetimes).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/522

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 20 Mar 2018 09:35:33 -0700

>From Kyle N: We could annotate the certificate to enable opt-in.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/522#issuecomment-374666576