Standing on our own two feet • Hacker News Board

Re: Standing on our own two feet

#21

Post by Aissen » Fri, Nov 06, 2020, 6:06 PM UTC

cpach wrote: post #19

WorldMaker wrote: post #15

Earlier quoted context omitted.

Root certificate updates are a massive security issue. Blaming Let's Encrypt is blaming one of the canaries for the coal mine disaster. 33% of Android devices don't and can't get up to date root certificates is an impressive security crisis that grows worse by the year (look at the other root expirations and the crazy workarounds that for instance Netflix has been doing to still work on older Android devices). Should…

That makes me curious, what workarounds did Netflix employ?

When you control the client, it's simple, you can do pretty much anything: embed your own HTTP stack, TLS stack, your QUIC stack, or simply your PKI, or subset of the webPKI.

Re: Standing on our own two feet

#22

Post by juliend2 » Fri, Nov 06, 2020, 6:11 PM UTC

zero37z wrote: post #18

now the corporates got a valid point, why you dont want to use lets encrypt? still the 33% of the devices is a quite a large number to consider.

But like they said in the article, those 33% of Android phones represent "1-5% of the traffic" of the "large integrators" websites that LE communicated with.

Re: Standing on our own two feet

#23

Post by lixtra » Fri, Nov 06, 2020, 6:12 PM UTC

They propose to install Firefox to work around the root certificate problem on old android devices. But can’t you just manually install their root certificate on most phones?

Re: Standing on our own two feet

#24

Post by WorldMaker » Fri, Nov 06, 2020, 6:13 PM UTC

cpach wrote: post #19

WorldMaker wrote: post #15

Earlier quoted context omitted.

Root certificate updates are a massive security issue. Blaming Let's Encrypt is blaming one of the canaries for the coal mine disaster. 33% of Android devices don't and can't get up to date root certificates is an impressive security crisis that grows worse by the year (look at the other root expirations and the crazy workarounds that for instance Netflix has been doing to still work on older Android devices). Should…

That makes me curious, what workarounds did Netflix employ?

It was the BBC I was actually thinking about, and it's a part of this article (which also mentions this Let's Encrypt root change):

https://scotthelme.co.uk/impending-doom-root-ca-expiring-leg...

Previous HN discussion on that article: https://news.ycombinator.com/item?id=23455463

Re: Standing on our own two feet

#25

Post by renewiltord » Fri, Nov 06, 2020, 6:16 PM UTC

> The remaining 33.8% of Android devices will eventually start getting certificate errors when users visit sites that have a Let’s Encrypt certificate. In our communications with large integrators, we have found that this represents around 1-5% of traffic to their sites.

This one-third of Android devices only yields 5% of traffic? Interesting.

Re: Standing on our own two feet

#26

Post by tothrowaway » Fri, Nov 06, 2020, 6:19 PM UTC

> As of January 11, 2021, we’re planning to make a change to our API so that ACME clients will, by default, serve a certificate chain that leads to ISRG Root X1.

Ouch. So anyone who wants to support older devices 3 months from now needs to add `--preferred-chain "DST Root CA X3"` to their certbot command. When that chain is completely retired in September next year, certbot appears to fallback on the default (even with that argument present).

Re: Standing on our own two feet

#27

Post by degenerate » Fri, Nov 06, 2020, 6:23 PM UTC

renewiltord wrote: post #25

> The remaining 33.8% of Android devices will eventually start getting certificate errors when users visit sites that have a Let’s Encrypt certificate. In our communications with large integrators, we have found that this represents around 1-5% of traffic to their sites. This one-third of Android devices only yields 5% of traffic? Interesting.

I have a 2010 Android smartphone and it's painfully slow to navigate the modern web, almost unbearable. Browsing news websites is simply not worth my time of waiting for the phone to download and process 22MB of JS, CSS, and graphics. Being on wifi makes no difference; it's the CPU choking to render all that cruft.

So yeah, 5% of traffic makes sense.

Re: Standing on our own two feet

#28

Post by notatoad » Fri, Nov 06, 2020, 6:24 PM UTC

est31 wrote: post #5

brendanclune wrote: post #4

Earlier quoted context omitted.

Workaround is Firefox Mobile (because it ships with its own root certs), but that's a significant burden to place on the user.

Also the post says that Firefox doesn't work on Androids older than 5.0 which according to the dashboard are still 5.9% of devices. For those older devices, the only option is to install the new root certificate. Anyways, there are billions of Android devices out there. 33% of those is a large number. You can't just tell all of them that they are wrong. If this happens, people will move away from Let's encrypt in mas…

on androids older than 5, the browser is the old android browser instead of chrome. how many sites out there still test compatability with that?

even without having to click through security warnings, the web is horribly broken on old android devices. the overlap of sites using letsencrypt and sites that care about people using android <5 has got to be vanishingly small. this isn't going to cause a move away from letsencrypt.

Re: Standing on our own two feet

#29

Post by notatoad » Fri, Nov 06, 2020, 6:26 PM UTC

renewiltord wrote: post #25

> The remaining 33.8% of Android devices will eventually start getting certificate errors when users visit sites that have a Let’s Encrypt certificate. In our communications with large integrators, we have found that this represents around 1-5% of traffic to their sites. This one-third of Android devices only yields 5% of traffic? Interesting.

there's a lot of old android phones out there that don't get used for anything other than making phone calls or sending texts.

Re: Standing on our own two feet

#30

Post by est31 » Fri, Nov 06, 2020, 6:29 PM UTC

WorldMaker wrote: post #15

est31 wrote: post #5

Earlier quoted context omitted.

Also the post says that Firefox doesn't work on Androids older than 5.0 which according to the dashboard are still 5.9% of devices. For those older devices, the only option is to install the new root certificate. Anyways, there are billions of Android devices out there. 33% of those is a large number. You can't just tell all of them that they are wrong. If this happens, people will move away from Let's encrypt in mas…

Root certificate updates are a massive security issue. Blaming Let's Encrypt is blaming one of the canaries for the coal mine disaster. 33% of Android devices don't and can't get up to date root certificates is an impressive security crisis that grows worse by the year (look at the other root expirations and the crazy workarounds that for instance Netflix has been doing to still work on older Android devices). Should…

Yes the issue is really severe of most deployed Android devices not getting security updates, either at all, or the devices are used well beyond the update period.

But this is not up to Let's Encrypt to solve. They market themselves to build products for the mass market instead of small niches of the market, say, everyone who buys a new phone every year. But then they also have to treat their product like a mass market product, and if Android users still use older versions of the OS, then Let's Encrypt should adopt for that.