-
@bagder @PCTuning_OW @jpmens No there is no. "per se" short renew may be better in case of not seen compromission […]Permalink On twitter.com
Mood 0
-
@bagder @PCTuning_OW @jpmens […] because in this case, you need to redo compromission ever and ever, and raise probability to be seen. […]Permalink On twitter.com
Mood 0
-
@bagder @PCTuning_OW @jpmens […] But with overall X.509/TLS ecosystem (DANE, HSTS, HPKP, OCSP stapling…), shortening cert renew is worse.Permalink On twitter.com
Mood -3 🙁
-
@bagder @PCTuning_OW @jpmens Typically in HPKP, the time between a HPKP change and first HPKP expiration is critical […]Permalink On twitter.com
Mood 0
-
@bagder @PCTuning_OW @jpmens You have no choice in case of compromission during this period : you need to keep compromised material online.Permalink On twitter.com
Mood -1 🙁
-
@bagder @PCTuning_OW @jpmens If you renew key each 90d with recommended 60d HPKP expiration, you only have 30d of real security…On twitter.com
Mood +2 🙂