Subject: Re: [websec] #56: Specify includeSubdomains directive for HPKP

From: "websec issue tracker" <[email-masked]>
Date: Fri, 22 Mar 2013 22:21:39 -0000

#56: Specify includeSubdomains directive for HPKP

Comment (by [email-masked]):

 TODO: Discuss the problem that, given that we prefer (2), Pinned Host
 operators will have a problem if UAs by chance happen to visit Google.com
 first, and then second try to visit WWW.Google.com. Due to
 includeSubdomains, the pins A and B will take effect, and Pin Validation
 will fail, *before the UA has a chance to note the pin C for
 WWW.Google.com*. Host operators SHOULD take this problem into account when
 deploying Pinned Hosts.

-- 
-------------------------------+--------------------------------
 Reporter:  [email-masked]  |       Owner:  [email-masked]
     Type:  defect             |      Status:  assigned
 Priority:  major              |   Milestone:
Component:  key-pinning        |     Version:
 Severity:  -                  |  Resolution:
 Keywords:  includeSubdomains  |
-------------------------------+--------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/websec/trac/ticket/56#comment:2>
websec <http://tools.ietf.org/websec/>

---

From: "websec issue tracker" <[email-masked]>
Date: Fri, 22 Mar 2013 22:47:53 -0000

I have added language to the working copy of the draft
 (https://code.google.com/p/key-pinning-draft/source/browse/draft-ietf-
 websec-key-pinning.xml) in the Security Considerations section.

Ticket URL: <http://tools.ietf.org/wg/websec/trac/ticket/56#comment:3>
websec <http://tools.ietf.org/websec/>

---

From: Yoav Nir <[email-masked]>
Date: Sat, 23 Mar 2013 02:15:17 +0000

That text works for me. 

On Mar 22, 2013, at 6:47 PM, websec issue tracker <[email-masked]> wrote:

> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec
> 
> Email secured by Check Point