Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS 18 breaks IMAPS self-signed certs

forums.developer.apple.com

Post reply on HN
Print view View original

111–120 of 157 posts

Re: iOS 18 breaks IMAPS self-signed certs

#111

Post by detourdog »

ehhthing wrote: post #109
hedora wrote: post #74

Earlier quoted context omitted.

That adds a lot of attack surface vs. issuing a self-signed cert and confirming it was securely verified by your imap client. Not only could let’s encrypt issue a mitm cert for your imap connections, so could other CAs, and any cloud providers / dns providers you use.

iOS never supported this configuration regardless, a change in SSL certificate does not cause any kind of notification to the user. Also, you're basically objecting to the entire idea of PKI for use in IMAP which is incredibly hard to justify. Perhaps you wish to use a different model for your own personal reasons but the default being PKI should not be controversial, and if you want to use your own model you should…

It did support it. One had to trust the certificate manually. I gave up on self-signed cents about 6 years ago.

Re: iOS 18 breaks IMAPS self-signed certs

#112

Post by detourdog »

compsciphd wrote: post #104
ho_schi wrote: post #100

Earlier quoted context omitted.

A threat model which people using self-signed certificates especially care about. The idea of certificate authorities, certificate chains and intermediary certificates is common - and based on top down security. That is the reason why it is so dangerous. There is a “lock” and people believe everything is “good” but actually DigiNotar, TurkTrust or the bad government issued a certificate. Google tried more than once t…

why use a self signed certificate, why not create your own signer cert install that into IOS and then its no longer a "self signed" cert, but just a private cert org. IOS does allow you to install private signer certs, right? (right?)

The rest of the world considers it self signed A standalone CA is great for everyone that can get manually trust it.

Re: iOS 18 breaks IMAPS self-signed certs

#113

Post by Arnt »

DidYaWipe wrote: post #101
kijin wrote: post #88

Earlier quoted context omitted.

Because you chose to use a program that doesn't accept self-signed certificates. Use a different program or a different computer that actually respects your freedom to tinker with it. Problem solved.

No. He noted that it's a REGRESSION. So he chose one that DID accept them. Running away from defects doesn't get them fixed.

Self-signed certs were a defect — people were used to just click OK and blackhats exploited that.

OP wants support for the special case where only the cert issuer trusts the cert (he has his own self-signed cert). Apple and others do support that: You make a private CA, trust that CA in the device, and then use that CA to sign certs for your IMAP server. IIRC (and this is from vague memory) you may need to configure yourself to be a company that manages employees' devices.

Re: iOS 18 breaks IMAPS self-signed certs

#114

Post by digitalPhonix »

anamexis wrote: post #47
darknavi wrote: post #39

Earlier quoted context omitted.

Can't you install trusted certificates by hand on iOS?

Yes, and you still can. That's not broken.

Based on the bug report I think it is. Mail is not respecting the self signed certificate that’s been added to the user trust store.

Re: iOS 18 breaks IMAPS self-signed certs

#115

Post by Arnt »

compsciphd wrote: post #104
ho_schi wrote: post #100

Earlier quoted context omitted.

A threat model which people using self-signed certificates especially care about. The idea of certificate authorities, certificate chains and intermediary certificates is common - and based on top down security. That is the reason why it is so dangerous. There is a “lock” and people believe everything is “good” but actually DigiNotar, TurkTrust or the bad government issued a certificate. Google tried more than once t…

why use a self signed certificate, why not create your own signer cert install that into IOS and then its no longer a "self signed" cert, but just a private cert org. IOS does allow you to install private signer certs, right? (right?)

An employer installed one on my then-phone, so it should be within reach of the kind of tech who deals with self-signed certs.

Re: iOS 18 breaks IMAPS self-signed certs

#116

Post by digitalPhonix »

User11110 wrote: post #50
lxgr wrote: post #46

Earlier quoted context omitted.

It really only is for bad practical reasons, that all coincidentally make it harder and harder to self-host stuff locally without paying a few dollars a month or year here and there to various rent seekers. "Just use Letsencrypt" really is the correct answer for 99% of use cases, but good luck if you find yourself with one from the 1%. You'll get an army of people mindlessly parroting "best practices" and will assume…

Internal CAs and self signed certificates are different. You can still generate a CA, sign your certificates, import your own CA into your phone and have that verify your certificates. You don't need Letsencrypt. But you'll learn in time.

How? An internal CA is just a self-signed certificate that you’ve told your device to trust; and to trust other certificates signed by it.

Somewhere you still need to trust a self-signed certificate.

Re: iOS 18 breaks IMAPS self-signed certs

#117

Post by outofpaper »

actionfromafar wrote: post #108
ho_schi wrote: post #100

Earlier quoted context omitted.

A threat model which people using self-signed certificates especially care about. The idea of certificate authorities, certificate chains and intermediary certificates is common - and based on top down security. That is the reason why it is so dangerous. There is a “lock” and people believe everything is “good” but actually DigiNotar, TurkTrust or the bad government issued a certificate. Google tried more than once t…

There are or were two kinds of people using self-signed certificates. The vast majority used to be "I don't know how or can't afford to get a certificate chain cert." Now, with letsencrypt, what's left of the "can't afford group" is "I can't be arsed to update my config yet".

Just because many people using self-signed certs are at the "don't know" stage isn't a reason to invalidate them.

Re: iOS 18 breaks IMAPS self-signed certs

#118

Post by Arnt »

kortilla wrote: post #93
Arnt wrote: post #43

Earlier quoted context omitted.

LE doesn't need any A or AAAA record. The domain must exist in the DNS and you must be able to create records in the domain. If you're using internet mail you have a domain, so you can do this. The time for self-signed certificates has passed.

A pinned self cert is still more secure than this because you don’t have to trust any CAs. > The time for self-signed certificates has passed. This is bad blanket advice and very much depends on use-case.

Software is a collective. A billion or so people get the same software. The time for self-signed certs has passed because supporting that in software for a billion people opens up some of that billion to attack.

The few people who understand the niceties of certs can create a private CA, trust that, and use that CA to sign a regular cert. Doing that is nontrivial, but it doesn't put other people at risk.

Re: iOS 18 breaks IMAPS self-signed certs

#119

Post by moduspol »

tadfisher wrote: post #30
punnerud wrote: post #27

I wish they could break Snapchat, Facebook etcs ‘s self-signed certs. I own the device, why can’t I see the traffic to and from all of these apps if I add my self-signed cert and approve to use a MITM-proxy. Most apps work, but not everyone. Often called certificate pinning.

Apple isn't doing certificate pinning, it's the apps verifying the certificate chain themselves by baking in public keys (or hashes/fingerprints). So there's not really a way for Apple to break this.

Actually it depends. Apple does provide a way to configure your app for certificate pinning, which then allows you to pin certificates without any changes in your code. [1]

Any apps that set up certificate pinning this way could be bypassed by Apple, though obviously there would be little value in them doing it since that'd just lead to app developers doing what you're describing instead.

Though if I'm understanding this correctly, jailbroken phones could probably bypass it by modifying an app's Info.plist and running the app despite the broken signature.

[1] https://developer.apple.com/news/?id=g9ejcf8y

Re: iOS 18 breaks IMAPS self-signed certs

#120

Post by benmmurphy »

saagarjha wrote: post #107
benmmurphy wrote: post #58

Earlier quoted context omitted.

If you jailbreak your phone then you are able to remove certificate pinning. If you just want to do this for research purposes then you can buy an old iPhone6s, iPhone8 or iPhoneX and use checkra1n which uses a bug early in the bootchain in order to jailbreak the phone. I think palera1n is based on checkra1n and might have better support for newer iOS versions: https://palera.in/

No need to jailbreak to remove pinning; you just need to patch the app itself (for example, by replacing the certificate it verifies against or the code that does the verification).

you need some way to decrypt the app store app so you know what you are modifying and so you can resign which usually involves a jailbreak. maybe there are these apps that only have the first page encrypted so potentially you don't need to decrypt these apps because you can guess what the first page is.
Post reply on HN