Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let’s Encrypt comes up with workaround for abandonware Android devices

arstechnica.com

Post reply on HN
Print view View original

51–60 of 132 posts

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#51

Post by maxerickson »

pyb wrote: post #47

"The new cross-sign will expire in early 2024, and hopefully versions of Android from 2016 and earlier will be dead by then." Hard disagree. In this day and age, a device or OS that is merely 8 years old should be able to function! Is the issue limited to Lets Encrypt? If so its usage should be discouraged.

It's the interaction of certificate expiration with no OS updates.

The lack of OS updates happen to correlate with hardware age for Android phones.

That's also the reasonable place to apply pressure, to the people marketing devices with minimal future support, which means they quickly become insecure.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#52

Post by forty »

Semaphor wrote: post #49
pyb wrote: post #47

"The new cross-sign will expire in early 2024, and hopefully versions of Android from 2016 and earlier will be dead by then." Hard disagree. In this day and age, a device or OS that is merely 8 years old should be able to function! Is the issue limited to Lets Encrypt? If so its usage should be discouraged.

Just FYI, the issue is with certificates in general, nothing to do with LE specifically. Dumbed down, the problem is that someone the old device never heard of, is not trustworthy. Of course, an OS should still work after 8 years. But the problem is, that the OS has been abandoned (by the device manufacturer and possibly the community), so it is falling apart. Anything that accesses the internet needs regular mainten…

I think it's a bit LE specific here though, since according to the article, real trust anchors do not expire on android, so it's only because LE is relatively new and was not a bundled CA root at the time, and had to be signed by a CA that was bundled (and this intermediate signature is what expires if I understand correctly)

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#53

Post by anfilt »

Causality1 wrote: post #42
vbezhenar wrote: post #16

Earlier quoted context omitted.

You can remove expired certificates from the list of revoked certificates. Without expiration time that list could grow limitless making it impractical.

I know the concept is offensive to us who love optimization and efficiency, but would it actually be impractical, though? A root certificate is a couple of kilobytes. How much space would you need to store every single certificate in history for the next hundred years?

For root certs probably not too much space, but for all certs.... That depends on the number of certs issued, and more people and things are using TLS and such so it probably be more than just linear growth. 100 Years seems a bit extreme just even look back 20 years for the terms of hardware and such. Also think about how much common MD5 was then and SHA1, both of which are broken for a lot use cases.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#54

Post by blacklight »

Trusted certificates should be treated as a separate (system) package that can also be upgraded without the whole OS being upgraded. That's how they are treated on most of the Linux distros out there.

Android has opted instead for tightly coupling the certificates to the system itself. That's a very bad design decision that, either intentionally or unintentionally, makes a device useless 4 years after the latest system upgrade.

One more reason for either ditching Google's Android in favour of better supported and less abandonware-prone systems - Lineage is an excellent choice for those who don't want to give up the commodities of Android, but don't want to run the risk of throwing away their $1000 phone 4-5 years after the purchase just because Google decided not to push certificate updates to it anymore.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#55

Post by bonzini »

Leherenn wrote: post #14
bonzini wrote: post #4

What about iOS? Which is the oldest version that has the Let's Encrypt certificate?

I don't think it's an issue on iOS, Apple is able and willing to update old devices if needs be. My 5S still receives the odd security update in iOS 12 from time to time (basically when something really big comes up). If it would make sense, I'm pretty sure Apple could update the first iPhone still. And that would cover every iPhone 1 in existence. Android with its fragmentation makes that pretty much impossible.

I have an iOS 9 device (a 2011 iPad) at home which in theory has updates pending, but it's not able to install them. I guess I could try a factory reset, I will think about it in 2024. :)

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#56

Post by danmg »

Jonnax wrote: post #36
zelienople wrote: post #8

>Today, your example eight-years-obsolete install base of Android starts with version 4.2, which occupies 0.8 percent of the market. Instead of hoping that the 0.8% will shrink over the next 4 years, Let's Encrypt should understand that the 0.8% are the sane, reasonable people who realize that their Android devices still work fine for their intended purpose and do not have to be mindlessly upgraded because of mass-me…

Why are you going after Let's Encrypt and not the manufacturers and hardware vendors that abandoned the devices? The source code for the device drivers are not available to be able to update these phones to the latest version of Android. These devices are insecure. Using them is not sane.

You're really going to scrap your car from 2015 because the off-brand android doo-hicky they stuck in it hasn't been updated?

Even if you're technically inclined, it's not like installing some community provided roms image on your slightly out-of-date flagship phone. The device likely has some proprietary aspects to it which would render it useless even if you attempted.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#57

Post by reaperhulk »

anfilt wrote: post #53
Causality1 wrote: post #42

Earlier quoted context omitted.

I know the concept is offensive to us who love optimization and efficiency, but would it actually be impractical, though? A root certificate is a couple of kilobytes. How much space would you need to store every single certificate in history for the next hundred years?

For root certs probably not too much space, but for all certs.... That depends on the number of certs issued, and more people and things are using TLS and such so it probably be more than just linear growth. 100 Years seems a bit extreme just even look back 20 years for the terms of hardware and such. Also think about how much common MD5 was then and SHA1, both of which are broken for a lot use cases.

A good example of how rapidly a CRL can grow in size is Apple's WWDRCA CRL. Current size: 224MB despite only containing revocations back to Feb 2020. http://developer.apple.com/certificationauthority/wwdrca.crl

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#58

Post by lvs »

intricatedetail wrote: post #10

Not sure why author writes using negative language about the fact that Android cannot be remotely updated? To me that sounds like an agenda to encourage the use of less privacy conscious operating systems. If the OS can be remotely updated, nothing stops bad actor from updating particular phone with a keylogger to bypass any end to end messenger a target is using and so on. Remote update is a great option if it is in…

It's infuriating that device manufacturers refuse not only to provide a viable update scheme for their devices, but that they lock out any chance for a FOSS solution to the problem either.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#59

Post by jniedrauer »

dotancohen wrote: post #13
intricatedetail wrote: post #10

Not sure why author writes using negative language about the fact that Android cannot be remotely updated? To me that sounds like an agenda to encourage the use of less privacy conscious operating systems. If the OS can be remotely updated, nothing stops bad actor from updating particular phone with a keylogger to bypass any end to end messenger a target is using and so on. Remote update is a great option if it is in…

Let's assume that you are correct. I am now holding a perfectly-fine Samsung Note 3, purchased new in 2013 and has never had a broken screen. To which trusted source can I initiate a remote update?

LineageOS allows users to stay on a reasonably secure up-to-date android version. Unfortunately, the initial install process is not user friendly enough for the average person who owns one of these devices. That's the barrier to entry. But once installed, this wouldn't be a problem.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#60

Post by move-on-by »

pyb wrote: post #47

"The new cross-sign will expire in early 2024, and hopefully versions of Android from 2016 and earlier will be dead by then." Hard disagree. In this day and age, a device or OS that is merely 8 years old should be able to function! Is the issue limited to Lets Encrypt? If so its usage should be discouraged.

I just got some combo smoke and carbon monoxide detectors that say replace every 7 years, so perhaps 8 years isn’t that bad?
Post reply on HN