Rook, Chrome on Windows uses CryptoAPI on other platforms they use NSS but NSS's revocation platform isn't "Faster" and doesnt send nonces (by default) either - its actually the least performant and robust revocation implementation of all the browsers.
There are a bunch of pending improvements to the NSS revocation behavior that should fix this in the near future.
We offer OCSP services for our products, one of the larger pool of responders on the internet; the number of requests we get with nonces approaches 0 (almost none).
makerofthings - Java applications will each behave differently, its possible to get Java to send nonces, sign requests, etc; its all up to the application.
As for the original request, there is limited protection to replays based on time (see security considerations in - http://www.ietf.org/rfc/rfc5019.txt). Supporting nonces also requires dynamically signing OCSP responses, Symantec issues 3 billion OCSP responses a day under normal load and this is with cached responses. Introducing dynamic signing would both be several orders of magnitude more expensive to operate (especially globally) but also expose them to a trivial resource consumption DOS.
Nonces make the most sense in the enterprise where signed requests also have a chance of working, if you want to use them you should look at installing a revocation provider in windows like the Axway desktop validator.
@rmhrisk
