Earlier quoted context omitted.
It's a good point. At any given time, the key is either compromised or it's not. And you may or may not know either way. If it's compromised, and you know, then it should be revoked -- if your only mechanism to revoke it is waiting some amount of time (several days, months, or even a decade) you have a pretty big problem. If you don't have a way to detect if it's compromised, rotating a precaution almost makes sense…
I'd say sign the next root certificate with previous root key, then you can rotate root key automatically. Browser update works the same way: you download new browser with new root certificate authenticated by previous root key.
The Impending Doom of Expiring Root CAs and Legacy Clients
201–209 of 209 posts
Re: The Impending Doom of Expiring Root CAs and Legacy Clients
#202Earlier quoted context omitted.
What we did for our old tv, was to get a chromecast after 3-4 years. This might be a cheaper and more environmentally friendly approach than yours, as we then buy one «smart-device», but you might end up with 2, over 12 years. But then some (all?) smart tv offerings have issues with terms and conditions, privacy, etc which may make them undesirable for you.
Pro-tip: you can usually un-accept privacy policies on Smart TVs and this reverts them to "dumb" TVs. This disables built-in apps and may make "software updates" unavailable but that's actually what you want anyway.
Re: The Impending Doom of Expiring Root CAs and Legacy Clients
#203Earlier quoted context omitted.
I'd say sign the next root certificate with previous root key, then you can rotate root key automatically. Browser update works the same way: you download new browser with new root certificate authenticated by previous root key.
Most roots are required to be cross-signed today by all the major browser and OS vendors. What you have is a classic web of trust issue because it's the new key that has the signatures attached so you could take the new key/certificate at its word, but if the problem is the previous root expiring, how do you trust that the new root certificate was signed by the previous root before it expired? You can't trust the now…
Re: The Impending Doom of Expiring Root CAs and Legacy Clients
#204Earlier quoted context omitted.
> ... I wanted a 4K monitor. To all the folks reading at home... I would remind everyone that a TV is not a monitor. I got a relatively inexpensive LG 43in TV to use as a desktop monitor. I've had issues. Beyond the usual "make sure your graphics card actually supports 4K" and such, you also need to take some time to dig through the TV settings when you are using it on a PC. In particular, you definitely want to turn…
As a side note, if you want to watch 4K video, keep in mind that as of right now, _the_ main draw of 4K is HDR (most 4K video out there is upscaled), and most cheaper 4K screens (both TVs and monitors) don't support HDR. Or if they claim they do, they only "support" HDR in that the monitor does tonemapping in hardware but can't render HDR colors. The technology is still new enough that getting the cheapest 4K screen…
Re: The Impending Doom of Expiring Root CAs and Legacy Clients
#205"Impending" doom? Devices from 10 years ago are _already_ useless online. Not only are the root certificates completely expired, but let's see which protocols does an openssl 0.9.8 build from a decade ago have in common with, say, current Gmail's IMAPS server: NONE.
Re: The Impending Doom of Expiring Root CAs and Legacy Clients
#206Earlier quoted context omitted.
Pro-tip: you can usually un-accept privacy policies on Smart TVs and this reverts them to "dumb" TVs. This disables built-in apps and may make "software updates" unavailable but that's actually what you want anyway.
How would I do this?
Re: The Impending Doom of Expiring Root CAs and Legacy Clients
#207Earlier quoted context omitted.
Most roots are required to be cross-signed today by all the major browser and OS vendors. What you have is a classic web of trust issue because it's the new key that has the signatures attached so you could take the new key/certificate at its word, but if the problem is the previous root expiring, how do you trust that the new root certificate was signed by the previous root before it expired? You can't trust the now…
Same as with the browser update: you receive it before the previous certificate expired.
Again, roots are already cross-signed and the article points out they still take 2+ years to pass other validity checks for root adoption. Even if they "virally" propagated in this manner after all those checks passed, there are plenty of devices that are only powered on once a year or less; there are a lot of devices whose support lifetimes for any upgrades at all are less than 2 years (that's a specific call in the article: we need security support lifetimes extended to decades at least, probably).
If they propagate "virally" you have a lot of questions of whether or not a device will even see that there is an updated certificate. Not every user or device visits a web page in a certificate chain to any given root routinely much less ever.
Comments to this article even point out that there is a semi-viral update process already in place in most browsers called AIA chasing, where certificates may point to URLs to look up their parent authorities, and Mozilla intentionally doesn't AIA chase because it's very definitely a privacy risk, even if you don't agree that it is a security risk (bad certificates sending you to bad URLs). The security risk is why the browsers that do AIA chasing only allow it for intermediate certificates and will not trust new roots found by AIA chasing.
Re: The Impending Doom of Expiring Root CAs and Legacy Clients
#208Once again the persuit of security theater to meet the requirements of commerce (which most of the web doesn't share) cause problems accessing the large parts of the normal web. When are people going to learn that centralized cert authorities are just for commerce and only hurt the non-commercial web?
Curious - what do you suggest for non-commercial web, taking into account both privacy and security?
Re: The Impending Doom of Expiring Root CAs and Legacy Clients
#209Earlier quoted context omitted.
I purposely bought and expensive one that’s pure android tv where you can disable all the tracking bits
You bought an Android device to avoid tracking? lol As long as you're using binaries that were compiled by Google I wouldn't trust them one bit. If you use LineageOS on your TV you might be a little better off.