Live data from Hacker News

Let’s Encrypt comes up with workaround for abandonware Android devices

arstechnica.com

131–132 of 132 posts

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#131
post #130

Earlier quoted context omitted.

> "Mostly"?! That's quite a stretch! You're attributing direct and explicit actions taken by a specific subset of site operators as caused by the device manufacturer, which it is clearly not! The sites disabled those methods because they were no longer secure. We know that TLS implementations lose security over time. Anyone locking in a specific implementation and specific certs knows it will stop being fully secure…

When you start with a premise that all sites MUST have HTTPS and MUST NOT support TLSv1.0 in each argument, then your arguments are simply unsound, because they're based on an incorrect premise, so, the conclusion couldn't possibly follow, because the underlying premise is false and thus cannot support any of your conclusions. My point about capitalism is exactly that -- capitalism -- Google, Bing, even Amazon (i.e.,…

According to capitalism it's okay for banks to lose your money and it's your problem for having your identity stolen, go spend a dozen hours to get things fixed. And they won't use secure passwords on their site, and they'll use fake 2-factor, because those incidents don't bother them enough to want to prevent.

So when capitalism says a type of security isn't necessary, well, other than a nihilist "nothing is necessary" attitude, I don't believe them. And it doesn't prove that what a company does is "just as secure" as best practices.

> When you start with a premise that all sites MUST have HTTPS and MUST NOT support TLSv1.0 in each argument, then your arguments are simply unsound, because they're based on an incorrect premise

Whew, good thing I wasn't doing that.

> If you intentionally disable your blog from working on such older devices, shifting the blame to device manufacturer is simply ludicrous!

Let me try to be clear again, since you definitely misread me.

Disabling HTTP is on the site owner.

HTTPS breaking is the manufacturer's fault. The site can influence how it breaks, but no matter what a very old implementation will be broken. At a certain point you can't even get certificates any more because all the roots are expired.

> All my sites are HTTP-only

So you don't want your users to even be able to opt in to privacy or protection from hostile networks?

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#132
post #83

Earlier quoted context omitted.

I see a lot of discussion about server certificates. But does there exist ocsp stapling for clients at all?

No, I don't think so. According to RFC 6066, Section 8 "Certificate Status Request" (a.k.a OCSP Stapling)... > In order to indicate their desire to receive certificate status information, clients MAY include an extension of type "status_request" in the (extended) client hello. Servers that receive a client hello containing the "status_request" extension MAY return a suitable certificate status response to the client…

This is indeed as far as I got as well. Maybe we can make it if we made an ssl extension ourselves but I’m not versed enough in them. It also would require controlling all ssl libraries in use.
Post reply on HN