91–96 of 96 posts
This was a major outage in the UK causing millions of people not to have data access on their phones. https://www.bbc.co.uk/news/business-46464730
Earlier quoted context omitted.
Expiry dates are in years, if a key is compromised, then an adversary has _years_ to exploit a MITM. However we already mitigate this with revocation lists. But if we can revoke certificates why do we have expiration dates? Seems to me expiration dates are rent seeking behaviour by certificate vendors.
This is a reason to shorten expiration times, not remove them (which companies like LetsEncrypt are doing)
Earlier quoted context omitted.
Expiry dates are in years, if a key is compromised, then an adversary has _years_ to exploit a MITM. However we already mitigate this with revocation lists. But if we can revoke certificates why do we have expiration dates? Seems to me expiration dates are rent seeking behaviour by certificate vendors.
Just a few years ago, almost nothing checked the revocation lists. I revoked certs for some popular domains and was concerned about ssl caches and proxies... turns out, an owl heard it. An odd dog barked. No impact. Not even from the folks that embedded our certs onto their servers for legacy code reasons. Perhaps this has changed over the last couple of years.
You're not secure if you don't check revocation.
Earlier quoted context omitted.
Just a few years ago, almost nothing checked the revocation lists. I revoked certs for some popular domains and was concerned about ssl caches and proxies... turns out, an owl heard it. An odd dog barked. No impact. Not even from the folks that embedded our certs onto their servers for legacy code reasons. Perhaps this has changed over the last couple of years.
Yep. But that's an implementation problem. Revocation is a critical security feature. Complaining that people didn't used to check it is like complaining that people didn't used to encrypt. You're not secure if you don't check revocation.
Earlier quoted context omitted.
Instead of waiting last minute, you'd think a large company would have planning to renew certificates X amount of time before they expire. Alas I understand it's not that simple.
You'd certainly think so. If you have frontend probers that exercise your accessible endpoints (HTTP or whatever) then those probes should fail when the certificate expires in less than 30 days. I couldn't comment on whether an organization like Ericsson or O2 would be expected to have such probers.
Thanks for the reminder.