3 ms·

While it would eliminate privacy concerns, it would also likely break an enormous number of websites which don't implement OCSP stapling, or don't implement it

While it would eliminate privacy concerns, it would also likely break an enormous number of websites which don't implement OCSP stapling, or don't implement it correctly.

eqvinox 2y ago
I'd suggest making browsers soft-enforce it with e.g. a yellow URL bar, giving server operators a window of time to fix things.
- nick238 2y ago
  I think with the whole menagerie of green locks, green bars & EV sites replacing/cluttering the address bar (meh [0]), only showing PSL+1 [1] (which actually does help security, but vocal power-users hate [2])...UI/UX designers are probably loathe to mess with it again. [0]: https://www.troyhunt.com/extended-validation-certificates-are-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... [1]: https://blog.chromium.org/2020/08/helping-people-spot-spoofs-url.html https://blog.chromium.org/2020/08/helping-people-spot-spoofs... [2]: https://www.reddit.com/r/chrome/comments/h11gde/how_do_i_stop_chrome_from_hiding_the_url_in_the/ https://www.reddit.com/r/chrome/comments/h11gde/how_do_i_sto... [3]: https://www.wired.com/story/google-chrome-kill-url-first-steps/ https://www.wired.com/story/google-chrome-kill-url-first-ste...
  - Dylan16807 2y ago
    Does highlighting the domain name not give the boost in security? I don't mind highlighting. And it's possible to get very aggressive with highlighting. At the very least it should have a [...] and not completely hide the fact that there is a URL.
- mcpherrinm 2y ago
  The browsers, generally, are not onboard with improving OCSP and supporting OCSP stapling. Chrome already doesn't check OCSP at all. Apple and Firefox are all working on out-of-band revocation information based on CRL data. Presumably Chrome and its family are going to go down that path too, but I'm not sure I've heard commitments from them yet. Firefox has the best documentation on what's happening: https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/ https://blog.mozilla.org/security/2020/01/09/crlite-part-1-a...
  - Avamander 2y ago
    Firefox does respect must-staple flag and requires a valid stapled response though.
doctorpangloss 2y ago
You talk about it like there’s a vibrant community of websites out there. There’s streaming sites and social media, and then a bunch of apps that are delivered through the web. All of them are sophisticated web operations.
- fragmede 2y ago
  in practice I think you're right, but oof.
- mcpherrinm 2y ago
  Let's Encrypt's goal has always been to support the vibrant community of websites, extending TLS to the long tail. The handful of streaming and social media sites can always go to a big commercial CA and spend a few hundred bucks a year on certs that do whatever they need.
- patmorgan23 2y ago
  The Internet is more than sophisticated big tech companies.

While it would eliminate privacy concerns, it would also likely break an enormous number of websites which don't implement OCSP stapling, or don't implement it correctly.

eqvinox 2y ago

I'd suggest making browsers soft-enforce it with e.g. a yellow URL bar, giving server operators a window of time to fix things.

nick238 2y ago
I think with the whole menagerie of green locks, green bars & EV sites replacing/cluttering the address bar (meh [0]), only showing PSL+1 [1] (which actually does help security, but vocal power-users hate [2])...UI/UX designers are probably loathe to mess with it again. [0]: https://www.troyhunt.com/extended-validation-certificates-are-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... [1]: https://blog.chromium.org/2020/08/helping-people-spot-spoofs-url.html https://blog.chromium.org/2020/08/helping-people-spot-spoofs... [2]: https://www.reddit.com/r/chrome/comments/h11gde/how_do_i_stop_chrome_from_hiding_the_url_in_the/ https://www.reddit.com/r/chrome/comments/h11gde/how_do_i_sto... [3]: https://www.wired.com/story/google-chrome-kill-url-first-steps/ https://www.wired.com/story/google-chrome-kill-url-first-ste...
- Dylan16807 2y ago
  Does highlighting the domain name not give the boost in security? I don't mind highlighting. And it's possible to get very aggressive with highlighting. At the very least it should have a [...] and not completely hide the fact that there is a URL.
mcpherrinm 2y ago
The browsers, generally, are not onboard with improving OCSP and supporting OCSP stapling. Chrome already doesn't check OCSP at all. Apple and Firefox are all working on out-of-band revocation information based on CRL data. Presumably Chrome and its family are going to go down that path too, but I'm not sure I've heard commitments from them yet. Firefox has the best documentation on what's happening: https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/ https://blog.mozilla.org/security/2020/01/09/crlite-part-1-a...
- Avamander 2y ago
  Firefox does respect must-staple flag and requires a valid stapled response though.

doctorpangloss 2y ago

You talk about it like there’s a vibrant community of websites out there. There’s streaming sites and social media, and then a bunch of apps that are delivered through the web. All of them are sophisticated web operations.

fragmede 2y ago
in practice I think you're right, but oof.
mcpherrinm 2y ago
Let's Encrypt's goal has always been to support the vibrant community of websites, extending TLS to the long tail. The handful of streaming and social media sites can always go to a big commercial CA and spend a few hundred bucks a year on certs that do whatever they need.
patmorgan23 2y ago
The Internet is more than sophisticated big tech companies.