5 ms·

Why not hard-fail by default and give the user the option to ignore/override it? Similar to the way other certificate warnings are shown to the end-user.

x0x0 13y ago
answered in adam's blog; see the paragraph beginning with Everyone does soft-fail
- dwightgunning 13y ago
  I guess that's true when a hard-fail causes the connection to be refused immediately by the client with no user input. In that case a DoS on the OCSP servers breaks things badly. However what I meant to suggest is a third option. Something like hard-fail with a latch. The client should opt to fail but give the user the choice to proceed. This would seem more desirable than the current soft-fail implementations when seem to be entirely silent to the end user.
  - richardwhiuk 13y ago
    Users make terrible security decisions. ~95% of users click through certificate failure pages, ~99% of users don't notice if a website transparently downgrades to HTTP. Delegating the choice, which would be borderline impossible to explain to the user is another way of saying 'Always say yes to proceed'.
- psykovsky 13y ago
  That is simply not true. Firefox does hard-fail with the default settings.
  - sp332 13y ago
    I'm sure it doesn't. I just checked Options -> Advanced -> Certificates -> Revocation, and it's not checked by default.
    - psykovsky 13y ago
      And I'm sure you are wrong. I only see a Validation option(not Revocation), which has 2 more options on how to check OCSP, and those are both checked using the defaults. The correct path on my OS is Edit -> Preferences -> Advanced -> Certificates -> Validation -> OCSP options(both checked)
      - magicalist 13y ago
        I think you've altered your settings at some point. It's not the default. You would see a huge influx of bugzilla entries of "Firefox is broken" if hard fail was the default. edit: the checkbox in the validation subdialog (ocsp.xul) is tied to security.OCSP.require, which is set here with a default of false in the Firefox source: http://dxr.mozilla.org/mozilla-central/source/netwerk/base/public/security-prefs.js#55 http://dxr.mozilla.org/mozilla-central/source/netwerk/base/p...
        psykovsky 13y ago
        > I think you've altered your settings at some point. It's not the default. I think some extension or some other thing changed them for me. I don't remember ever opening the OCSP dialog until now :/
      - mpyne 13y ago
        I just checked, and the checkbox for enabling hard-fail is unchecked with my default Firefox settings.

x0x0 13y ago

answered in adam's blog; see the paragraph beginning with Everyone does soft-fail

dwightgunning 13y ago
I guess that's true when a hard-fail causes the connection to be refused immediately by the client with no user input. In that case a DoS on the OCSP servers breaks things badly. However what I meant to suggest is a third option. Something like hard-fail with a latch. The client should opt to fail but give the user the choice to proceed. This would seem more desirable than the current soft-fail implementations when seem to be entirely silent to the end user.
- richardwhiuk 13y ago
  Users make terrible security decisions. ~95% of users click through certificate failure pages, ~99% of users don't notice if a website transparently downgrades to HTTP. Delegating the choice, which would be borderline impossible to explain to the user is another way of saying 'Always say yes to proceed'.
psykovsky 13y ago
That is simply not true. Firefox does hard-fail with the default settings.
- sp332 13y ago
  I'm sure it doesn't. I just checked Options -> Advanced -> Certificates -> Revocation, and it's not checked by default.
  - psykovsky 13y ago
    And I'm sure you are wrong. I only see a Validation option(not Revocation), which has 2 more options on how to check OCSP, and those are both checked using the defaults. The correct path on my OS is Edit -> Preferences -> Advanced -> Certificates -> Validation -> OCSP options(both checked)
    - magicalist 13y ago
      I think you've altered your settings at some point. It's not the default. You would see a huge influx of bugzilla entries of "Firefox is broken" if hard fail was the default. edit: the checkbox in the validation subdialog (ocsp.xul) is tied to security.OCSP.require, which is set here with a default of false in the Firefox source: http://dxr.mozilla.org/mozilla-central/source/netwerk/base/public/security-prefs.js#55 http://dxr.mozilla.org/mozilla-central/source/netwerk/base/p...
      - psykovsky 13y ago
        > I think you've altered your settings at some point. It's not the default. I think some extension or some other thing changed them for me. I don't remember ever opening the OCSP dialog until now :/
    - mpyne 13y ago
      I just checked, and the checkbox for enabling hard-fail is unchecked with my default Firefox settings.