Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Impending Doom of Expiring Root CAs and Legacy Clients

scotthelme.co.uk

Post reply on HN
Print view View original

31–40 of 209 posts

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#31

Post by topkai22 »

Certificates suck. They are monumentally user unfriendly and complex. How many major internet properties have had outages driven by certificate renewal in the last several years? Half? I know that enterprises I work with seem to have some sort of work impacting certificate problem every month.

The ecosystem needs to become a lot more robust and user friendly in general. Unfortunately, I’m just a user of certificates not a cryptographer, so I’m not really qualified to design security critical aspects of the system, but here are some rough features that I’m looking for:

- certificate warning date: a time period defined like expiry date that indicates that clients should warn of impending expiration but still click though

- Make it easier for people to acquire and renew certs. Let’s encrypt is an amazing start here, but it’s not a universal solution yet

- Formalize a way to solve the key distribution problem described in the article. Again, I’m not a security expert, but perhaps embedding a “replaces” concept into a certificate would work.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#33

Post by 1bc29b36f623ba8 »

briffle wrote: post #8
pletnes wrote: post #4

Earlier quoted context omitted.

What we did for our old tv, was to get a chromecast after 3-4 years. This might be a cheaper and more environmentally friendly approach than yours, as we then buy one «smart-device», but you might end up with 2, over 12 years. But then some (all?) smart tv offerings have issues with terms and conditions, privacy, etc which may make them undesirable for you.

I never hooked up the smart tv to my wireless network. I have heard too many stories about data getting sent back to the manufacturers to sell your watching habits, etc. Instead, I use a Roku, that I know gets updates (and yes, they also sell your watching habits, but so far, nextdns.io's lists block the DNS that roku uses to do this.)

I have a dummy hotspot with no access to anything whatsoever, and which I allow my TV to connect to. Apart from exposing an undocumented API (with code execution capabilities), and allowing logging in as root over Telnet (without a password), it also tries to fetch software updates over plain HTTP. It's a bloody nightmare.

On the plus side, it was possible to disable many of the smart features once I discovered the telnet capability. :D

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#34

Post by gindely »

koolba wrote: post #22
hanklazard wrote: post #9

Earlier quoted context omitted.

Someone on HN recently floated the idea of a company that would make quality, non-smart electronics and appliances that would also be easily serviceable. I wish this existed and would pay significantly more for products like this. To address your question, I think they’re all “smart” now. I ended up getting a low-end Samsung 4K a few months ago and it’s been good so far. It starts up very quickly, maybe 1-2 seconds.…

Never add your WiFi credentials you your TV. It doesn’t let you remove them so you’re only option is to create a “dummy” network (ex: phone as a hotspot) and switch to it. Also, watch out for clueless^helpful friends and relatives who try to “fix” your TV’s WiFi.

(ot: should that be clueless^Whelpful, or is there some new convention I'm not aware of? ^ still means "ctrl" right?)

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#35

Post by the8472 »

geerlingguy wrote: post #3

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

Search for public/info/commercial displays if you want dumb(ish) large monitors.

https://geizhals.eu/?cat=monplas

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#36

Post by gkop »

gindely wrote: post #34
koolba wrote: post #22

Earlier quoted context omitted.

Never add your WiFi credentials you your TV. It doesn’t let you remove them so you’re only option is to create a “dummy” network (ex: phone as a hotspot) and switch to it. Also, watch out for clueless^helpful friends and relatives who try to “fix” your TV’s WiFi.

(ot: should that be clueless^Whelpful, or is there some new convention I'm not aware of? ^ still means "ctrl" right?)

The parent is using it to mean https://en.wikipedia.org/wiki/Logical_conjunction

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#37

Post by myself248 »

hanklazard wrote: post #9
geerlingguy wrote: post #3

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

Someone on HN recently floated the idea of a company that would make quality, non-smart electronics and appliances that would also be easily serviceable. I wish this existed and would pay significantly more for products like this. To address your question, I think they’re all “smart” now. I ended up getting a low-end Samsung 4K a few months ago and it’s been good so far. It starts up very quickly, maybe 1-2 seconds.…

Specifically for TVs, you can get a new display driver board for whatever panel is in there. Eats HDMI/DP, spits out eDP or VBO or whatever the panel format is. Often these are pretty basic, with a minimal OSD pasted in by the Shenzhen seller who configures the thing to your order.

Personally I'm trying to get my hands on the SDK for the software that runs in the driver chip (does the OSD and the scaling and everything else), because I think there's a lot of potential there. But boy it's like pulling teeth.

Similarly, the Exploiteers (née GTVHacker) have done quite a bit of reverse-engineering of the stock boards, so you can just fix the broken-ass firmware they ship with.

Ultimately I'm picturing something like the WRT54G, a single modem that the community coalesces around, to the point that a decade later, third-party firmwares have become such a force that manufacturers build hardware specifically to run it.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#38

Post by mschuster91 »

I got hit at work by the AddTrust issue too, quite a bit of a nightmare to chase down, especially Java keystores. And that was mostly because there exist clients who barf if they have a valid working chain but also another chain where one of the certs has expired!

For embedded devices - it's not just smart TVs but all IoT devices! - I think that the solution is a legal requirement: a condition of a device being able to be sold on the EU / US market must be the commit of the whole source tree and build chain including any and all key material for signing firmwares to the national library or other government-run secure escrow, to be released to the public once the manufacturer discontinues the product support. Similar to like you can't sell a product without adhering to the CE and electrical safety standards, manufacturers should not be able to sell products without having them certified for IT safety and e-waste/"planned obsolescence" issues!

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#39

Post by thisisnico »

LeonM wrote: post #29
beervirus wrote: post #27

Earlier quoted context omitted.

> Sony dropped playstation support for my 4K monitor in an irreversible software update What kind of support does it need? Isn't it just an HDMI cable?

My guess is the TV must support DRM

HDCP?

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#40

Post by [deleted] »

topkai22 wrote: post #31

Certificates suck. They are monumentally user unfriendly and complex. How many major internet properties have had outages driven by certificate renewal in the last several years? Half? I know that enterprises I work with seem to have some sort of work impacting certificate problem every month. The ecosystem needs to become a lot more robust and user friendly in general. Unfortunately, I’m just a user of certificates…

[deleted]
Post reply on HN