Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6-Day and IP Address Certificates Are Generally Available

letsencrypt.org

Post reply on HN
Print view View original

111–120 of 290 posts

Re: 6-Day and IP Address Certificates Are Generally Available

#111

Post by woodruffw »

Sohcahtoa82 wrote: post #45
bigstrat2003 wrote: post #38

Earlier quoted context omitted.

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.

It's really security theater, too. Though if I may put on my tinfoil hat for a moment, I wonder if current algorithms for certificate signing have been broken by some government agency or hacker group and now they're able to generate valid certificates. But I guess if that were true, then shorter cert lives wouldn't save you.

One of the ideas behind short-lived certificates is to put certificate lifetimes within the envelope of CRL efficacy, since CRLs themselves don’t scale well and are a significant source of operational challenges for CAs.

This makes sense from a security perspective, insofar as you agree with the baseline position that revocations should always be honored in a timely manner.

Re: 6-Day and IP Address Certificates Are Generally Available

#112

Post by bayindirh »

midtake wrote: post #101

Why 6 day and not 8? - 8 is a lucky number and a power of 2 - 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout - 6 is the value of every digit in the number of the beast - I just don't like 6!

Because it allows to you to work for six days, and rest on the seventh. Like God did.

Re: 6-Day and IP Address Certificates Are Generally Available

#113

Post by huhhuh »

gizmo686 wrote: post #110
londons_explore wrote: post #69

Earlier quoted context omitted.

But isn't it unnecessary to use https, since tor itself encrypts and verifies the identity of the endpoint?

It would give you a certificate chain which may authenticate the onion service as being operated as who it purports to. Of course, depending on context, a certificate that is useful for that purpose might itself be too much if an information leak

DV certificates (that lets encrypt) provides offer no verification of the owner. EV certificates for .onion could be actually useful though, but one generally has to pay for EV cert.

Re: 6-Day and IP Address Certificates Are Generally Available

#114

Post by arianvanp »

progbits wrote: post #56
xg15 wrote: post #47

IP addresses must be accessible from the internet, so still no way to support TLS for LAN devices without manual setup or angering security researchers.

I mean if it's not routable how do you want to prove ownership in a way nobody else can? Just make a domain name.

For ipv6 proof of ownership can easily be done with an outbound connection instead. And would work great for provisioning certs for internal only services.

Re: 6-Day and IP Address Certificates Are Generally Available

#115

Post by woodruffw »

jdsully wrote: post #80
bigstrat2003 wrote: post #38

Earlier quoted context omitted.

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.

At some point it makes sense to just let us use self signed certs. Nobody believes SSL is providing attestation anyways.

What does attestation mean in this context? The point of the Web PKI is to provide consistent cryptographic identity for online resources, not necessarily trustworthy ones.

(The classic problem with self-signed certs being that TOFU doesn’t scale to millions of users, particularly ones who don’t know what a certificate fingerprint is or what it means when it changes.)

Re: 6-Day and IP Address Certificates Are Generally Available

#116

Post by [deleted] »

dextercd wrote: post #92
razakel wrote: post #60

Has anyone actually given a good explanation as to why TLS Client Auth is being removed?

It's a requirement from the Chrome root program. This page is probably the best resource on why they want this: https://googlechrome.github.io/chromerootprogram/moving-forw...

[deleted]

Re: 6-Day and IP Address Certificates Are Generally Available

#117

Post by halifaxbeard »

midtake wrote: post #101

Why 6 day and not 8? - 8 is a lucky number and a power of 2 - 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout - 6 is the value of every digit in the number of the beast - I just don't like 6!

> 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout

There’s your answer.

6 days means on a long enough enough timeframe the load will end up evenly distributed across a week.

8 days would result in things getting hammered on specific days of the week.

Re: 6-Day and IP Address Certificates Are Generally Available

#118

Post by zja »

midtake wrote: post #101

Why 6 day and not 8? - 8 is a lucky number and a power of 2 - 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout - 6 is the value of every digit in the number of the beast - I just don't like 6!

The are some great points

Re: 6-Day and IP Address Certificates Are Generally Available

#119

Post by hamdingers »

midtake wrote: post #101

Why 6 day and not 8? - 8 is a lucky number and a power of 2 - 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout - 6 is the value of every digit in the number of the beast - I just don't like 6!

It's actually 6 and 2/3rds! I'm trying to figure out a rationale for 160 hours and similarly coming up empty, if anyone knows I'd be interested.

200 would be a nice round number that gets you to 8 1/3 days, so it comes with the benefits of weekly rotation.

Post reply on HN