Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari will no longer trust certs valid for more than 13 months

theregister.co.uk

Post reply on HN
Print view View original

141–150 of 179 posts

Re: Safari will no longer trust certs valid for more than 13 months

#141

Post by jchw »

swiley wrote: post #140
jchw wrote: post #102

Earlier quoted context omitted.

> Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future. I mean... How do you expect to have a valid, trusted TLS certificate without a third party? Nobody says it has to be Lets Encrypt or Cloudflare or Amazon load balancers or ... so forth. Some certificate authorities even already have APIs....

A lot of other apps that use asymmetric crypto to authenticate the other end allow for “trust on first contact” for establishing trust. It’s a little disappointing that many browsers have no support for this whatsoever and most have very poor support for it.

TOFU has its problems too, but its neither here nor there; CAs have been a part of HTTPS and SSL since the 90s. This news item, to me, does not signify any shift in whether a third party is needed or not.

Re: Safari will no longer trust certs valid for more than 13 months

#142

Post by jchw »

mikedilger wrote: post #129
jchw wrote: post #102

Earlier quoted context omitted.

> Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future. I mean... How do you expect to have a valid, trusted TLS certificate without a third party? Nobody says it has to be Lets Encrypt or Cloudflare or Amazon load balancers or ... so forth. Some certificate authorities even already have APIs....

No third party is strictly necessary. You have to know what the servers public key is in a reliable way. That doesn't necessarily mean a third party has to be involved. Maybe you call them on the phone and check the fingerprint. Maybe it's your server and you sneakernet the key to your client. And to appease the dumb protocol you wrap it up as a certificate (self-signed) and accept yourself as trustworthy (what a con…

My point is that this news item does not change reliance on a third party at all. Not that it’s impossible to exist.

Re: Safari will no longer trust certs valid for more than 13 months

#143

Post by est31 »

superkuh wrote: post #39

There are two mutually exclusive views of the web. As a set of protocols to allow individual humans to share information about things they love and the web as a set of protocols to make a living. There are real reasons for the for-profit web to want to limited cert lifetimes since revocation doesn't really work in practice. In terms of browser dev the two views are mutually exclusive and the one that funds the coders…

You can always run your own company-internal or limited-to-your-home CA and add it as custom root CA to every browser in that domain. These maximum certificate validity rules IIRC don't affect custom root CAs you added.

I agree with you that the web is being commercialized, but limiting certificate lifetimes isn't the problem. It's rather stuff like the .org domain sale, google amp, Chrome killing the file:// protocol (after all, html files don't have ads inside them, can't be indexed and they don't make any money for Google), FLOSS projects adopting discord, etc.

Re: Safari will no longer trust certs valid for more than 13 months

#144

Post by tialaramex »

TeMPOraL wrote: post #97
tialaramex wrote: post #74

Earlier quoted context omitted.

CT didn't change this for bad guys. If you're a bad guy (or a neutral researcher with a budget for the data) you can buy what's called "Passive DNS". Several suppliers will give you a list of DNS requests and their answers, the identifying information for who made the requests is elided so it's not PII but it has the same effect of making the fact servername.example.com exists in effect public information. Even if yo…

I never heard about Passive DNS before. Thanks. That said, shouldn't that be illegal? Where does this data come from anyway? I'm guessing spyware - on the phone, in browsers, and spyware browsers like Chrome.

Unless the people answering DNS queries for you have explicitly contracted (with you, or with all users) not to do this you should assume they contribute to one or more passive DNS services because it's free revenue for them.

I'd be very surprised if any of the suppliers use spyware, seems like it'd be far less effective and also more expensive to do.

Re: Safari will no longer trust certs valid for more than 13 months

#145

Post by jsjddbbwj »

superkuh wrote: post #39

There are two mutually exclusive views of the web. As a set of protocols to allow individual humans to share information about things they love and the web as a set of protocols to make a living. There are real reasons for the for-profit web to want to limited cert lifetimes since revocation doesn't really work in practice. In terms of browser dev the two views are mutually exclusive and the one that funds the coders…

Sorry if this sounds dumb but this is a non sequitur for me. How does the for-profit web benefit from being able to revoke certificates? And why does revocation not work in practice? I thought all major browsers check their own lists to see if certs are revoked

Re: Safari will no longer trust certs valid for more than 13 months

#146

Post by asiachick »

j1elo wrote: post #53

Anybody knows why Safari on iOS will reject using self-signed certificates for WebSocket connections? (doesn't happen on desktop) This is a major annoyance since it is the only browser that does this and won't work with "wss://" URIs even after accepting the mandatory certificate exception. Accessing the page rightfully shows a warning on all browsers, to which the user can click on "Continue" or similar, to ignore t…

My guess is you're required to install your own private root cert on iOS for doing websocket dev.

https://www.howtogeek.com/253325/how-to-create-an-ios-config...

Re: Safari will no longer trust certs valid for more than 13 months

#147

Post by tialaramex »

Reelin wrote: post #83
simias wrote: post #37

Earlier quoted context omitted.

Without an expiration date the only way to retire a certificate would be to explicitly revoke it. That'd be a bit heavy handed IMO. Forcing certificates to expire means that domain ownership gets re-validated every time. Nobody would risk buying 2nd-hand domains for anything sensitive if the previous owners could have a permanently valid certificate stashed somewhere. Or you'd have to contact all the CAs that could'v…

Is there not already a standard procedure for certificate revocation on domain ownership transfer? It seems like there really should be - even a 13 month expiry is hardly enough to prevent intentional abuse.

"Standard" is a big ask. If this is a concern then you can proceed as follows:

1. Wait 24 hours or so after securing control over the names.

2. Use the Certificate Transparency logs to determine which certificates if any exist for names you now control and want revoked.

3. Discover the revocation process for the issuer of each cert.

4. Use each process you discovered. All of them should be willing to revoke if you can prove you now control these names. Some (Like Let's Encrypt) offer an automated way to do this, for others you may end up talking to a Customer services person or using an email ticket queue.

Re: Safari will no longer trust certs valid for more than 13 months

#148

Post by guug »

xg15 wrote: post #131
bad_user wrote: post #89

Earlier quoted context omitted.

With Let's Encrypt it's cheaper than ever to host a personal website over HTTPS with a certificate that updates itself. Due to Let's Encrypt, free hosting services like Netlify or GitHub Pages are now providing HTTPS certificates and installing it on your own server is pretty painless, if you're into managing your own server. And if your hosting provider doesn't support Let's Encrypt, you can always put Cloudflare in…

> Let's Encrypt [...] Netlify [...] GitHub Pages [...] your hosting provider [...] Cloudflare Those are exactly the kind of third-party services the GP was talking about. > if you're into managing your own server One of the core advantages of having a personal server has always been that you can keep it entirely off the internet and run it without any involvement of third-party services. That is not anymore possible.…

Not to mention people who can't obtain certs due to geopolitics or the inability to enter a legal agreement with the ISRG.

I understand why letsencrypt is needed and what problem it's trying to solve, but forcing international dependencies on a small number of select entities is not the way to go about solving them.

I can't help but feel saddened when see one of the greatest monuments to human ingenuity, a global decentralized network, get dismantled like this.

Re: Safari will no longer trust certs valid for more than 13 months

#149

Post by guug »

ryandrake wrote: post #128
wbl wrote: post #117

Earlier quoted context omitted.

DNS you always needed.

Not strictly necessary, but convenient. All browsers I know of allow you to browse to an IP address.

This shouldn't be downvoted. I distinctly remember browsing websites by their addresses.

Re: Safari will no longer trust certs valid for more than 13 months

#150

Post by Reelin »

tialaramex wrote: post #147
Reelin wrote: post #83

Earlier quoted context omitted.

Is there not already a standard procedure for certificate revocation on domain ownership transfer? It seems like there really should be - even a 13 month expiry is hardly enough to prevent intentional abuse.

"Standard" is a big ask. If this is a concern then you can proceed as follows: 1. Wait 24 hours or so after securing control over the names. 2. Use the Certificate Transparency logs to determine which certificates if any exist for names you now control and want revoked. 3. Discover the revocation process for the issuer of each cert. 4. Use each process you discovered. All of them should be willing to revoke if you ca…

Thanks for another clear explanation of process! But... the fact that there isn't some standardized automated revocation procedure that all CAs are required to support at this point seems somewhat absurd to me.

At a minimum, it seems like such processes based on both proof of domain ownership and proof of private key possession should exist. Moreover, there ought to be a way to specify via DNS which CAs can issue certificates for your domain (I guess DNSSEC DANE will provide this?).

Post reply on HN