<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Hi, sadly I noticed that OCSP (security.OCSP.enabled) is still enabled in the latest TBB, I hope you are all aware that this data is sent unencrypted and can be used by CA's to track users.</div>
<div> </div>
<div>OCSP Stapling has been a common feature of web servers since 2017, so I suppose we should rely on that instead?</div>
<div> </div>
<div>Firefox is configured to use OCSP Stabling by default, but I still see an unencrypted OCSP connection for every https:// connection.</div>
<div> </div>
<div>
<table>
<tbody>
<tr>
<td>security.ssl.enable_ocsp_stapling </td>
<td>= true</td>
</tr>
<tr>
<td>security.ssl.enable_ocsp_must_staple </td>
<td>= true</td>
</tr>
</tbody>
</table>
</div>
<div> security.OCSP.enabled = 0</div>
<div> </div>
<div>Best Regards,</div>
<div>Elise</div></div></body></html>