Can you expand further on the problem which you see?
Can you expand further on the problem which you see? Pinning appears to address the biggest problem with the current CA model, where any of the CAs are equally valid, by allowing you to pick the CA(s) used and, if desired, even locking it to a specific host certificate: https://tools.ietf.org/html/draft-ietf-websec-key-pinning-20... > To perform Pin Validation, the UA will compute the SPKI Fingerprints for each certificate in the Pinned Host's validated certificate chain, using each supported hash algorithm for each certificate. (As described in Section 2.4, certificates whose SPKI cannot be taken in isolation cannot be pinned.) The UA MUST ignore superfluous certificates in the chain that do not form part of the validating chain. The UA will then check that the set of these SPKI Fingerprints intersects the set of SPKI Fingerprints in that Pinned Host's Pinning Metadata. If there is set intersection, the UA continues with the connection as normal. Otherwise, the UA MUST treat this Pin Validation Failure as a non-recoverable error. Any procedure that matches the results of this Pin Validation procedure is considered equivalent. Unless I'm missing something, that allows you both to limit the number of CAs which you trust and if you go to the trouble of pinning specific certificates you can even limit damage from a compromised CA.
Posted by acdha on Jan 16, 2015, 2:12 AM
Tags
Related issues
- The biggest problem with having an LLM do this, from what I've observed of at least frontier models, is that the way they are trained...
- The biggest problem with MOND is that it was hand-crafted with additional parameters simply to fit the data.
- (My comment is about detached houses).
- The biggest problem with this is that I can't run my company's own internal benchmarks against this API, because they will be trained int...
- > steer Claude away from over-engineering parts of the system in response to hypothetical concerns.
- Why is there no comparison with FLUX 3 Image?
Raise real-world problems, find people facing the same issue, and discuss solutions.8,000 issues0 comments
hackernews (Other)
The biggest problem with having an LLM do this, from what I've observed of at least frontier models, is that the way they are trained...
The biggest problem with MOND is that it was hand-crafted with additional parameters simply to fit the data.
(My comment is about detached houses).
The biggest problem with this is that I can't run my company's own internal benchmarks against this API, because they will be trained int...
> steer Claude away from over-engineering parts of the system in response to hypothetical concerns.
Why is there no comparison with FLUX 3 Image?
> our Git monorepo was developing an annoying problem Sentences like this are so common from people using monorepos that I am convinced ...
Why is there no contact form?
Can you expand further on the problem which you see?
Can you expand further on the problem which you see? Pinning appears to address the biggest problem with the current CA model, where any of the CAs are equally valid, by allowing you to pick the CA(s) used and, if desired, even locking it to a specific host certificate: https://tools.ietf.org/html/draft-ietf-websec-key-pinning-20... > To perform Pin Validation, the UA will compute the SPKI Fingerprints for each certificate in the Pinned Host's validated certificate chain, using each supported hash algorithm for each certificate. (As described in Section 2.4, certificates whose SPKI cannot be taken in isolation cannot be pinned.) The UA MUST ignore superfluous certificates in the chain that do not form part of the validating chain. The UA will then check that the set of these SPKI Fingerprints intersects the set of SPKI Fingerprints in that Pinned Host's Pinning Metadata. If there is set intersection, the UA continues with the connection as normal. Otherwise, the UA MUST treat this Pin Validation Failure as a non-recoverable error. Any procedure that matches the results of this Pin Validation procedure is considered equivalent. Unless I'm missing something, that allows you both to limit the number of CAs which you trust and if you go to the trouble of pinning specific certificates you can even limit damage from a compromised CA.
Comments (0)
No comments yet. Start the discussion.