Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

131–140 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#131

Post by lvh »

markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

I genuinely believe that in 2020 the myriad of ways of getting automated TLS is easier than logging into a website and uploading a CSR and then placing that certificate somewhere.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#132

Post by hannob »

xg15 wrote: post #83
demersb wrote: post #72

Earlier quoted context omitted.

~$5/year (US) for a domain, and a one time investment of setting up a few scripts might save you a lot of time in the long run.

Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore. Even if my device is purely for LAN use and wouldn't need the internet at all, I now need to ensure it has an internet connection and I have to keep a domain owned that must be constantly renewed. The device will also only be accessible if an internet connection is present, even if both the device and the client are in the…

> Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore.

I'm wondering where the impression fo" not any more" comes from. Really the situation hasn't changed much. You can have your HTTP webinterface. You can have HTTPS with a selfsigned cert and click away the warning. The only thing that really has changed is that for your HTTP connection you will get a warning that the connection is not secure.

I don't think the ability of browsers to load HTTP pages will go away any time soon.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#133

Post by lawnchair_larry »

zozbot234 wrote: post #125
lawnchair_larry wrote: post #106

Earlier quoted context omitted.

TOFU doesn’t actually work. If you set up a TOFU cert environment, 100% of non-security people will click right through it, and 95% of security people will also click right through it. They’ll just assume that because it was untrusted the first time, that cert errors are normal and ignore it. Especially since they will have a “first use” for every new device and every new browser they visit with.

Funny how some people claim no one will ever click thru the TOFU warning screen because it's too scary and unfamiliar, whilst others say users will just click thru everything.

There’s an important distinction. My claim is that once a user is trained how to ignore a cert error for a particular site and add an exception, they will no longer pay any mind to that site or environment giving cert errors.

The general public, when surfing and hitting a cert error on a random site, will usually disengage.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#134

Post by dane-pgp »

est31 wrote: post #19

From the source code: https://chromium.googlesource.com/chromium/src/+/ae4d6809912... // For certificates issued on-or-after the BR effective date of 1 July 2012: // 60 months. // For certificates issued on-or-after 1 April 2015: 39 months. // For certificates issued on-or-after 1 March 2018: 825 days. // For certificates issued on-or-after 1 September 2020: 398 days. The source code also requires certificates issued…

On 30 April 2018 it became a requirement (in Chrome) for all certificates issued after that date to be recorded in a public Certificate Transparency log[0]. A certificate issued on 28 February 2018 could therefore be issued without being logged, while having a validity period of 39 months. Such a certificate would be valid until 28 May 2021.

Does that mean that next May, for the first time ever, the domains of all HTTPS sites on the web will be recorded in a public log? I think the only caveat to that is wildcard certificates.

[0] https://www.feistyduck.com/bulletproof-tls-newsletter/issue_...

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#135

Post by lvh »

slim wrote: post #24
SquareWheel wrote: post #12

To clarify, this is the limit for how long they can be to be considered valid. Certificates are encouraged to be of shorter lengths as it reduces their potential for abuse. If compromised, a certificate with a long lifespan could be used for years without anyone noticing. A system which doesn't check for revocation is especially vulnerable (though of course, browsers do). Let's Encrypt certificates are only valid thr…

which makes websites ephemeral and at the mercy of a few authorities. my torrent website could disappear within a few months behind a scary "this site is dangerous" notice

What does that have to do with certificate lifespan? Authorities go after your domain, not (typically) the CA. Longer certs don't help.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#136

Post by greatgib »

Remember the good old time when it was not an almighty cartel of browsers that controlled your internet?

This is so an arbitrary decision and so much a pain in the ass. Again, a limited number of people used their corporate interests to decide for the whole world with almost no discussion.

The worst is that the "security" argument for this change is quite weak. Yes, we can think that shorter certificates are a little bit better to trust for the user, but that should be the choice of the website that you visit.

Now, you as an user are so stupid, that browsers will decide for you what website is deemed safe for you to visit, the same as with appstores. Compared to the good old time, like traditional pc software installation, where it was you, the user that was free to decide the websites that you wanted to trust: google.com vs myshaddyfraudyweb.com

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#137

Post by lvh »

cm2187 wrote: post #63
jlgaddis wrote: post #58

Earlier quoted context omitted.

EDIT: Sorry, replied to the wrong comment! --- cf. https://support.apple.com/en-us/HT211025 : > This change will affect only TLS server certificates issued from the Root CAs preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS. > This change will not affect certificates issued from user-added or administrator-added Root CAs.

But what about Chromium and Mozilla?

Generally speaking locally installed certs have been exempted from most of the requirements levied on public certificates.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#138

Post by zozbot234 »

lawnchair_larry wrote: post #133
zozbot234 wrote: post #125

Earlier quoted context omitted.

Funny how some people claim no one will ever click thru the TOFU warning screen because it's too scary and unfamiliar, whilst others say users will just click thru everything.

There’s an important distinction. My claim is that once a user is trained how to ignore a cert error for a particular site and add an exception, they will no longer pay any mind to that site or environment giving cert errors. The general public, when surfing and hitting a cert error on a random site, will usually disengage.

If you've added a persistent exception, that means you've trusted that cert on your device so getting further cert errors would surely be unexpected.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#139

Post by AdamJacobMuller »

paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

I'm not a huge fan of it, but, it seems like the way things are going is to simply run a service which is basically a large proxy.

Your device connects out with some kind of persistent connection to their central service then requests to your device go to their server, which does AAA and routes to your local device. Fixes the SSL issue, avoids any NAT headaches, enables fully remote access and most importantly for PMs it makes the device useless without your server-side components. If there is any local accessibility at all, it can be neutered or reduced.

I don't entirely hate this model, its not my favorite, but, its the way things are going.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#140

Post by PersonalOps »

stefan_ wrote: post #117
secabeen wrote: post #112

Earlier quoted context omitted.

Do self-signed certs not work? Yes, you have to tell your browser to permanently accept them the first time you connect, but after that, they work.

Why as a vendor would you use a self-signed certificate that causes the browser to scream at the customer when you could just not use TLS, plain old HTTP.

Because the alternative is to embed a TLS private key that would allow you to MITM every other one of those devices. Someone extracted it? Looks like you have to either (a) bury your head in the sand or (b) rollout an expensive recall to change certs on those devices.

Why use slightly compromised HTTPS versus plaintext HTTP? Same reason they have those super cheap locks on diaries from the 90s: it's a deterrent. Makes it a little harder to do a bad thing.

Post reply on HN