Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

391–400 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#391

Post by rocqua »

AmericanChopper wrote: post #305
_wmd wrote: post #22

Earlier quoted context omitted.

Let's not forget multiple mobile networks across Europe went down on the same day last year because Ericsson(?) let a cert expire on some internal management system that had not been updated. SSL cert renewal is one of the great unsolved problems in computer science edit: not Europe, just UK and Japan apparently: https://www.zdnet.com/article/ericsson-expired-certificate-c...

>SSL cert renewal is one of the great unsolved problems in computer science Certificate expiry really only exists to make money for CAs. It doesn’t solve any security problem that CRLs don’t already solve (and solve better). There’s lots of unsolved problems relating to ‘how do you make a reliable PKI’, but cert expiry is really just an unrelated business requirement for CAs.

Cert revocation suffers from a very simple issue. If your check for revocation fails, do you fail open (ie accept the cert) or fail closed (ie reject the cert).

For any method, fail closed is user hostile and often a DOS vulnerability whilst fail open is another way for an attacker to use a revoked cert.

This is a big issue with on-line methods like OCSP as a MitM using a bad cert can probably block OCSP traffic as well.

CSLRs grow out of proportion, and leak information to the outside world.

Cert expiry serves as a backstop to these other revocation methods, and as a bonus ensures that simply forgetting about a cert cannot bite you 10 years later.

Re: All extensions disabled due to expiration of intermediate signing cert

#392

Post by josteink »

ssadler wrote: post #291
Causality1 wrote: post #179

Earlier quoted context omitted.

So why not just disable extension updates instead of disabling the extensions themselves?

Presumably because how would it differentiate between a legit "already installed" extension with a signature that cannot be verified, and an extension installed by malware that also cannot be verified?

> Presumably because how would it differentiate between a legit "already installed" extension with a signature that cannot be verified, and an extension installed by malware that also cannot be verified?

This is why a signature can also be accompanied by a trusted time stamp which can confirm that the signature was made while the certificate was valid.

This is the common way to sign all Windows software to avoid this exact kind of problem.

Yes, that implies this is a known and solved problem. It’s embarrassing for Mozilla to not have prepared for this.

Re: All extensions disabled due to expiration of intermediate signing cert

#393

Post by fnrslvr »

saulrh wrote: post #320
fnrslvr wrote: post #296

Mozilla doesn't seem to have communicated the issue well. I could imagine a lot of unsavvy users have tried some wild things in an attempt to fix the problem, and maybe made a mess in the process. Doesn't Mozilla have a mechanism for blasting out a message to all Firefox browsers? Also I have a Firefox account, why haven't I been inboxed about this? Otherwise I'm not bothered. I won't be switching as long as this get…

> Doesn't Mozilla have a mechanism for blasting out a message to all Firefox browsers? The cynical side of me says that it must not have this feature because if it did I'd have seen someone complaining about the browser "phoning home" or "forcing Mozilla's opinions into my eyeballs".

Yeah, I guess I could see people coming in with that take. Personally I'll gladly accept a tether to the mothership if they offer the choice.

That said, I regularly get thinkpieces from Mozilla about the open internet, privacy, requests for donation (which I often oblige), etc., in my inbox. They also drop notifications under the address bar and in a "Message from Firefox" bar at the bottom of the new tab page, which I got the impression they had some live control over.

But maybe not, and/or maybe there's a long runway on preparing correspondence by any of these channels for some reason. If anything, I hope that when they do get around to getting some wide-reaching messaging out there, they indicate that they plan on doing the work to shorten the runway on emergency messaging in future.

Re: All extensions disabled due to expiration of intermediate signing cert

#395

Post by reikonomusha »

notatoad wrote: post #217
mukundmr wrote: post #60

They have acknowledged the defect and are working on a fix. While this is a severe impact, I am still with Firefox. The are enough alternative browsers to tide over the problem for now. The fact that alternatives exist is the reason why we should support projects like Firefox.

>I am still with Firefox that's kinda the problem. there's plenty of reasons to be "with" firefox still, but you shouldn't need reasons other than it's the best browser. when it starts requiring loyalty to be a user, that's a big problem.

Don’t you think this is awfully dramatic?

Re: All extensions disabled due to expiration of intermediate signing cert

#397

Post by rocqua »

tialaramex wrote: post #389
Beldin wrote: post #357

Earlier quoted context omitted.

CRLs are not equivalent at all. They are a last-ditch effort to fix a problem when all else (expiry) has failed. CRLs require maintenance and distribution of a list by a 3rd party. Creating an accurate, all-inclusive CRL of all website keys that your browser should reject is far, far from easy. (Case in point: "how many web sites are there?" Is not an easy question. ) Properly propagating such a list to any browser t…

CRLs can be sharded, the cert carries the URL for the relevent CRL inside it. So they wouldn't need to have grown as huge as you suggest. But, this sharing carries a cost for user privacy, if I shard certs 16 ways then each CRL download gives me 4 bits of info about which sites you were visiting. OCSP effectively takes this to the extreme, each lookup is tiny because it's just for one cert, but it gives away exactly…

Besides leaking data by on demand CLR checking, you also have a difficult fail open v fail closed decision.

Failing closed means failure of a third party immediately breaks your site. Failing open means a MitM can simply block the CRL check.

OCSP stapling and the 'must staple' header are a lot better for privacy, and OCSP responses have some validity so at least a 5 hour outage of your CA doesn't bring your site down immediately.

It is still vulnerable to a DOS and trust on first use though.

Re: All extensions disabled due to expiration of intermediate signing cert

#398

Post by fnrslvr »

mirimir wrote: post #324
fnrslvr wrote: post #296

Mozilla doesn't seem to have communicated the issue well. I could imagine a lot of unsavvy users have tried some wild things in an attempt to fix the problem, and maybe made a mess in the process. Doesn't Mozilla have a mechanism for blasting out a message to all Firefox browsers? Also I have a Firefox account, why haven't I been inboxed about this? Otherwise I'm not bothered. I won't be switching as long as this get…

https://twitter.com/mozamo https://discourse.mozilla.org/t/certificate-issue-causing-ad...

lol, both pivotal sources that I'll swiftly consult when something in my browser goes haywire.

Seriously though, when I checked the Mozilla and Firefox twitters (and I don't use twitter, so even going that far was a stretch for me) just before I wrote the parent post, they hadn't gotten around to tweeting a notice about this there, either. The Mozilla Add-ons twitter account is not the highest-level place that should be talking about this situation.

Re: All extensions disabled due to expiration of intermediate signing cert

#399

Post by swalladge »

Grue3 wrote: post #390

What kind of idiot thought that the add-ons I have personally installed on my browser need to have a capability to be remotely disabled despite literally nothing being changed. This is absolutely inexcusable. I want to see everyone being responsible for this "verified add-ons" fiasco fired from the team (after they roll it back of course).

Exactly. If me/firefox has verified the signature (or approved the download) when downloading or updating the addon, that should be all that's necessary. Why does firefox have to check signatures constantly?

Re: All extensions disabled due to expiration of intermediate signing cert

#400

Post by tialaramex »

lvh wrote: post #200
wbl wrote: post #15

Earlier quoted context omitted.

We scan our codebase for anything that looks like a cert and send emails when it gets close. Might not have helped here if it was an intermediate owned by a CA. There but for the grace of God go I.

If you want to get rid of those and they're public certs: odds are they're in Certificate Transparency logs and you can monitor them from there.

Monitoring CT lets you verify that somebody renewed the certificate, but it doesn't verify they actually installed the replacement correctly.

My employer (Kynd.io) currently monitors public web sites for customers so we can flag e.g. "Hey this site cert expires in a week! If it's dead probably just switch it off, otherwise renew the certificate" and we're in the process of integrating CT but mostly so we can say "You already have a newer cert but need to go install it" in our How To Fix instructions.

Post reply on HN