4 ms·
However, it seems possible to explicitly use a secure browser (i.e. one that checks certificate revocations) if the need arises. You don’t need 99% browser-mark
by claudius 13y ago
However, it seems possible to explicitly use a secure browser (i.e. one that checks certificate revocations) if the need arises. You don’t need 99% browser-market coverage to allow people to securely connect to your site, nor do you need 99% browser-market coverage to securely connect to a given site. You only need that site to implement HTTPS, either with a self-signed cert and e.g. Certificate Patrol on your side or a CA-signed cert and a revocation-checking browser. In the latter case, you should also configure your browser to consider an OCSP failure an invalid certificate, not a valid one.
- AhtiK 13y agoThis all sounds good but at the same time only Firefox has OCSP Hard Fail feature (OCSP failure==invalid cert). Please correct me if it's still possible with others. Also user must become a rather paranoid person in order to start using a browser in mobile that supports hard fail OCSP. Getting HTTPS everywhere shouldn't mean promoting false sense of security. Considering that most HTTPS attacks require MITM it seems to me that OCSP without Hard Fail leaves attack vector wide open.