For some reason, Let's Encrypt failed to mention that older versions of Android can just import the ISRG Root X1 certificate, which solves the problem for all apps.
https://www.stoutner.com/lets-encrypt-isrg-root-x1-and-priva...
Standing on our own two feet
181–190 of 200 posts
Re: Standing on our own two feet
#182Earlier quoted context omitted.
Does anyone in enterprise actually need publicly trusted certificates for documents and email? Seems like it's an inside-the-firewall Exchange server for internal traffic, and a white-label "secure messaging center" portal for external traffic.
Using a public CA is far better for security than a custom private one. It's a pain having to install the certificate on every client, server, piece of software, etc. and in my experience this inevitably leads to people disabling certificate checking as part of troubleshooting and this being left on. Also, sometimes people need to access documents and emails from home computers and the company may use some devices on…
So exposing your internal infrastructure to the whole world and risking a 3rd party (CA) turning the keys (literally) to your kingdom to someone else is better than someone making a mistake that’s very easy to discover and correct?
> Also, sometimes people need to access documents and emails from home computers and the company may use some devices on which it isn't possible to install the CA
That’s a plus as far most security professionals are concerned
Re: Standing on our own two feet
#183Earlier quoted context omitted.
Is there enough incentive for Microsoft to add a root store to Edge by next September? How hard is it to make that addition?
I may be wrong, but the effort to switch to your own root store is more doing it securely, than the difficulty of switching from system frameworks to your own SSL/HTTP transport layers. So to put another way, straight forward to do mediocre job, not as trivial to do a good or great job.
Root store and TLS/HTTP library are separate concerns. You can use the system root store with your own libraries, or you can use your own root store with the system libraries.
On an Android 4.4 device, you should probably skip the system root store and the system libraries, and if you're already doing it for those phones, you might as well do it for all the phones.
Re: Standing on our own two feet
#184Earlier quoted context omitted.
The NSA can see what pages you read, and men in the middle can modify the page to insert malicious JS or ads or whatever without HTTPS.
The NSA can still see that just via the metadata of me making the connections necessary to load the encrypted page contents.
If they are focused on you then they can probably do that although it may take considerable work, such as spidering an entire web site to correlate resources on the site against timing and size information.
Without encryption we know the NSA takes the approach of just bulk collecting everything they can to filter after the fact.
So rather than an assigned agent trying to discern what Public Enemy #1 Lammy is up to right now, and painstakingly concluding you have probably just read a Wikipedia article about Jaffa cakes, if you don't have encryption what happens is that the automation notes "Lammy looked at http://en.wikipedia.org/wiki/Jaffa_Cakes" as you click and it goes into the vast heap of stuff snooped that second even though you aren't under any suspicion and it's probably irrelevant.
This bulk surveillance is an unjustified attack on everybody's privacy.
Re: Standing on our own two feet
#185Earlier quoted context omitted.
I may be wrong, but the effort to switch to your own root store is more doing it securely, than the difficulty of switching from system frameworks to your own SSL/HTTP transport layers. So to put another way, straight forward to do mediocre job, not as trivial to do a good or great job.
Root store and TLS/HTTP library are separate concerns. You can use the system root store with your own libraries, or you can use your own root store with the system libraries. On an Android 4.4 device, you should probably skip the system root store and the system libraries, and if you're already doing it for those phones, you might as well do it for all the phones.
> Root store and TLS/HTTP library are separate concerns.
In the context of this thread (aka older Android devices), they aren’t truly separate concerns. You really need to do both. My point is that doing both is relatively straightforward, but doing the root store part is fairly easy to do it in a mediocre way and be brittle / insecure.
Re: Standing on our own two feet
#186Earlier quoted context omitted.
Google does provide updates. It's the device manufacturers and/or mobile operators who choose not to push them.
But that model is flawed, and it's been more than a decade to learn that. The interesting thing is: We already have a model that works much better, and it's been around for longer. If you buy a computer with Windows it is completely normal that you still get your updates from Microsoft, even if your computer is built by a company that may no longer exist by the time you install the update. (That's not to say Windows…
Users of the Android OS are not Google's customers.
Re: Standing on our own two feet
#187Re: Standing on our own two feet
#188Earlier quoted context omitted.
Maybe IdenTrust will now offer an ACME compatible endpoint and offer signed, paid certs with their CA. Or another CA will. I wonder whether IdenTrust imagined that a five year cross signed root ca would be too little a timespan to get wide adoption. Btw... Wouldn't it be possible to just add a new root ca to android? Maybe an app could simplify delivery?
> Maybe an app could simplify delivery? I'd be very surprised if an app without root privileges could install a new root certificate. If an app installed a malicious (or even just a poor quality) certificate, that would be a pretty big compromise to the OS. What is strange to me though, is that it seems like the OS should have a mechanism to update the root certs independently of the OS itself. Then again, not updati…
I would imagine that the app could make the delivery smoother than "download a file on the filesystem, look for a menu somewhere where to add the root ca".
Maybe a single confirmation box "would you like to add this ca" would work.
Re: Standing on our own two feet
#189Earlier quoted context omitted.
But that model is flawed, and it's been more than a decade to learn that. The interesting thing is: We already have a model that works much better, and it's been around for longer. If you buy a computer with Windows it is completely normal that you still get your updates from Microsoft, even if your computer is built by a company that may no longer exist by the time you install the update. (That's not to say Windows…
Users of the Android OS are not Google's customers.
Most of them are. :) Except for Huawei, I haven't seen an Android user not using Google Play Services. There is probably statistically-insignificant number of users just having F-Droid on a LineageOS who do not use Play Store, Push services or don't consume their ads. So most Android users are indirectly also Google users.
Re: Standing on our own two feet
#190Earlier quoted context omitted.
Ok - next question then: why do browsers block self-signed certs? If Lets Encrypt now allows any domain to get a cert, what's the harm in a self-signed cert? Seems like a step up from plain HTTP.
The theory here is a self-signed cert could be from anyone (including the NSA) and you wouldn't know. Unless you explicitly trusted the certificate you were using, like enterprises do.
NSA can probably already issue certs from some of the widely-trusted roots. If someone as big as NSA wanted to MITM you, you wouldn't notice...