Subject: Re: [httpwg/http-extensions] Issues with server detection of attacks (#522)

From: HTTP issue updates <[email-masked]>
Date: Mon, 09 Apr 2018 13:25:17 -0700

I assume annotation would just be an OID on the certificate?  It makes me a little sad to say that all current certificates are invalid for this purpose, but there's definitely value in limiting the scope of a key compromise.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/522#issuecomment-379882659

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 10 Apr 2018 00:51:37 +0000 (UTC)

Yeah.  The standard approach is to include a critical extension and reject attempts to use an EE cert that doesn't include the extension.  We would probably only levy that requirement on servers though.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/522#issuecomment-379938925