Subject: Re: [websec] First Connection Active Attack in HPKP

From: Chris Palmer <[email-masked]>
Date: Tue, 13 May 2014 13:25:42 -0700

On Tue, Apr 29, 2014 at 4:28 AM, Tom Ritter <[email-masked]> wrote:

>> I see your point... is the attack so marginal that it doesn't matter
>> either way? I'm not sure I feel strongly any more on this topic.
>
> I would call the difference marginal only if the we never envision the
> report having anything done with it except immediate sending.  If it's
> stored for later, logged, a browser extension collects them all and
> sends them out through Tor or some other mechanism... then I would say
> it's not marginal.  And since those are possibilities, I would say it
> would be better to remove the paragraph and not have different
> behavior. It would also probably make the code simpler, too.

OK, reverted the dubious paragraph.

https://code.google.com/p/key-pinning-draft/source/detail?r=25d5bae1373def833a0d1091654ae5e712d32d40