Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let’s Encrypt comes up with workaround for abandonware Android devices

arstechnica.com

Post reply on HN
Print view View original

101–110 of 132 posts

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#101

Post by Mirioron »

anonymousiam wrote: post #75

Seems like there would be other serious problems with running an OS that hasn't been updated in four+ years. I'm not going to bother with a survey, but if memory serves, there have been at least a half dozen serious exploits revealed among different SSL libraries, bluetooth stacks, and WiFi. Maybe letting the certificates expire would have actually helped to secure the IoT.

>Maybe letting the certificates expire would have actually helped to secure the IoT.

You would also have hundreds of millions of people who can't connect to most websites anymore:

>Let's Encrypt says it was added to Android's CA store in version 7.1.1 (released December 2016) and, according to Google's official stats, 33.8 percent of active Android users are on a version older than that.

Not everyone can afford to buy a new phone every 4-5 years. You would alienate a lot of people from smartphones, from websites that use Let's Encrypt, or maybe even websites that use HTTPS.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#102

Post by Mirioron »

Jach wrote: post #48
gus_massa wrote: post #39

Earlier quoted context omitted.

The main problem with old devices is the battery. I don't like changing my phone too much, so I use it until the battery only is good for a 10 minute call or a day without calls, or one of my kids drop the phone and it gets broken. So I change it probably every three years, and sometimes my wife use the new phone and I use her old phone. (She use the phone more than me.) One possibility is that the manufactures add m…

To a large extent this is mitigated by having removable batteries. From what I've heard the Nexus 10 perhaps is a notable exception where the available alternate batteries aren't very good; mine needs a new battery but I don't really use it enough to justify one plus it's a somewhat more involved process than just popping it out. I'm still using a Note 3 from 2013, it's on its third battery (though the second probabl…

I've been using a OnePlus One since release and I can still use the web for hours. No removable battery in this one, but it seems to work fine.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#103

Post by Jach »

Mirioron wrote: post #102
Jach wrote: post #48

Earlier quoted context omitted.

To a large extent this is mitigated by having removable batteries. From what I've heard the Nexus 10 perhaps is a notable exception where the available alternate batteries aren't very good; mine needs a new battery but I don't really use it enough to justify one plus it's a somewhat more involved process than just popping it out. I'm still using a Note 3 from 2013, it's on its third battery (though the second probabl…

I've been using a OnePlus One since release and I can still use the web for hours. No removable battery in this one, but it seems to work fine.

Yeah, batteries can go for a surprisingly long time. Still, I'll never buy a phone without the ability to replace it. Apart from the benefits of replacing old batteries that only hold a fraction of their original charge, swappable batteries means I can take a spare with me if I need to, and I can increase the size. I've got a 7500 mAh chonker in my Note 3, slightly over 2x the stock battery, and it does many hours even watching video.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#104

Post by Schnitz »

michalhosna wrote: post #90
xacky wrote: post #86

Apple devices have the same issue. Any device running iOS 8 or lower can’t connect to tls 1.2 sites which is the majority of the internet.

How many devices are running iOS8 or older vs 7.1.1 or older? iOS8 released 2014. Newest iPhone that is stuck on iOS8 or older is iPhone 4 from 2010. Android 7.1.1 released 2016, many devices without any upgrade provided. There are Android phones from 2016 + 2017 that are stuck at 7.1. Apple devices does not have the same problem. (Android upgrade paths are super sad, you almost have to buy new phone every year to st…

It’s really a shame. I had no reason to buy a new phone other than Google ditching support for the Pixel 2, a high priced flagship, after only 3 years. Combine this with how much more Android phones depreciate compared to iPhones (who wants a device you can’t get security updates for) and it’d have been cheaper to buy an iPhone. Needless to say, I didn’t buy another Android. I don’t think the update situation will improve further to be honest, even Google doesn’t care enough to lead by example.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#105

Post by thayne »

bawolff wrote: post #95
thayne wrote: post #80

Earlier quoted context omitted.

> There's also lots of clients that don't check CRL This is in part due to the difficulty of doing so. On linux at least there is generally not a central location for CRLs, or anything to keep them up to date. Each application is responsible for maintinging CRLs it cares about itself. And then there is the fact that a full set of CRLs is pretty big. OCSP fixes some of that, at the cost of more latency during the TLS…

OCSP stapling always felt a little hacky to me. It feels like just having super short lived certificates but with extra steps. Why not just have super short lived certificates instesd?

That's fair.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#106

Post by thayne »

sciurus wrote: post #99
thayne wrote: post #80

Earlier quoted context omitted.

> There's also lots of clients that don't check CRL This is in part due to the difficulty of doing so. On linux at least there is generally not a central location for CRLs, or anything to keep them up to date. Each application is responsible for maintinging CRLs it cares about itself. And then there is the fact that a full set of CRLs is pretty big. OCSP fixes some of that, at the cost of more latency during the TLS…

If you haven't seen it already, check out https://blog.mozilla.org/security/2020/01/09/crlite-part-1-a... (Disclaimer: I work for Mozilla and have helped with the rollout of this)

That is certainly an interesting project, I wish it success, and it may very well improve things in the future. However, it looks like currently it is only experimentally used in firefox and isn't really easy to use in other applications. And even if there was a readily available library for consuming crlite files, there is still the problem of keeping the local crlite filter up to date and if you want to use different trust anchors than firefox, you would need to have the infrastructure to generate your own crlite filters periodically.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#107

Post by RinTohsaka »

Schnitz wrote: post #104
michalhosna wrote: post #90

Earlier quoted context omitted.

How many devices are running iOS8 or older vs 7.1.1 or older? iOS8 released 2014. Newest iPhone that is stuck on iOS8 or older is iPhone 4 from 2010. Android 7.1.1 released 2016, many devices without any upgrade provided. There are Android phones from 2016 + 2017 that are stuck at 7.1. Apple devices does not have the same problem. (Android upgrade paths are super sad, you almost have to buy new phone every year to st…

It’s really a shame. I had no reason to buy a new phone other than Google ditching support for the Pixel 2, a high priced flagship, after only 3 years. Combine this with how much more Android phones depreciate compared to iPhones (who wants a device you can’t get security updates for) and it’d have been cheaper to buy an iPhone. Needless to say, I didn’t buy another Android. I don’t think the update situation will im…

I have found Lineage OS to be a wonderful solution to this, although I understand this doesn't work easily for the masses.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#108

Post by fireant »

algesten wrote: post #17
krupan wrote: post #6

Earlier quoted context omitted.

I had a co-worker who was pushing for certs that were only valid for a day, or for hours or even minutes. It would solve the whole problem of revocation.

When I've implemented JWT in the past (yes, I know, "don't use JWT"), I've opted for public/private signatures. The public cert I would publish on some URL for all consumers of the JWT to use. The rotation of certs there was a matter of hours. It would hold 3-4 of the last certs (depending on JWT lifetime).

What's wrong with using JWTs? What you have done should be industry standard and is enabled by the JWK spec. In fact several features of OpenID Connect are built upon signed JWTs from a well-known JWK store.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#109

Post by Dylan16807 »

reaperhulk wrote: post #57
anfilt wrote: post #53

Earlier quoted context omitted.

For root certs probably not too much space, but for all certs.... That depends on the number of certs issued, and more people and things are using TLS and such so it probably be more than just linear growth. 100 Years seems a bit extreme just even look back 20 years for the terms of hardware and such. Also think about how much common MD5 was then and SHA1, both of which are broken for a lot use cases.

A good example of how rapidly a CRL can grow in size is Apple's WWDRCA CRL. Current size: 224MB despite only containing revocations back to Feb 2020. http://developer.apple.com/certificationauthority/wwdrca.crl

What in the world? Why are there millions of revoked certificates? What is creating all of these?

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#110

Post by Dylan16807 »

fireant wrote: post #108
algesten wrote: post #17

Earlier quoted context omitted.

When I've implemented JWT in the past (yes, I know, "don't use JWT"), I've opted for public/private signatures. The public cert I would publish on some URL for all consumers of the JWT to use. The rotation of certs there was a matter of hours. It would hold 3-4 of the last certs (depending on JWT lifetime).

What's wrong with using JWTs? What you have done should be industry standard and is enabled by the JWK spec. In fact several features of OpenID Connect are built upon signed JWTs from a well-known JWK store.

https://www.howmanydayssinceajwtalgnonevuln.com/

Having such a tempting footgun is a real problem.

Post reply on HN