Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla wants CAs to revoke 30 random certificates per year

groups.google.com

Post reply on HN
Print view View original

21–30 of 36 posts

Re: Mozilla wants CAs to revoke 30 random certificates per year

#21

Post by jonas21 »

agwa wrote: post #15
likeabatterycar wrote: post #7

Earlier quoted context omitted.

To put things into perspective, the people behind the browser with The reality is the CAs could tell Mozilla to go pound sand and they would have no recourse. Is there not a governing body for certificate policies with voting members? CA trust should be handled at the OS vendor level. Mozilla having its own trust anchors is a relic of the past. If CAs refuse to comply, they at worst inconvenience 2.5% of their custom…

Google Chrome also takes a hard line when it comes to revocation requirements, and Apple wants to limit certificate lifetimes to 45 days. Although neither have stated a position on random revocations, they are directionally aligned with Mozilla and you will be disappointed if you expect either of them to prioritize server operator convenience over the security of their users. As for Microsoft, they are simply asleep…

Don't you think there's a difference between having short certificate lifetimes (which would be clear when the certificate is issued), and randomly revoking perfectly good certificates without warning?

Re: Mozilla wants CAs to revoke 30 random certificates per year

#22

Post by likeabatterycar »

agwa wrote: post #15
likeabatterycar wrote: post #7

Earlier quoted context omitted.

To put things into perspective, the people behind the browser with The reality is the CAs could tell Mozilla to go pound sand and they would have no recourse. Is there not a governing body for certificate policies with voting members? CA trust should be handled at the OS vendor level. Mozilla having its own trust anchors is a relic of the past. If CAs refuse to comply, they at worst inconvenience 2.5% of their custom…

Google Chrome also takes a hard line when it comes to revocation requirements, and Apple wants to limit certificate lifetimes to 45 days. Although neither have stated a position on random revocations, they are directionally aligned with Mozilla and you will be disappointed if you expect either of them to prioritize server operator convenience over the security of their users. As for Microsoft, they are simply asleep…

> Google Chrome also takes a hard line when it comes to revocation requirements

Unless you run an enterprise CA, in which case Chrome doesn't check for revocation AT ALL. Google went rogue and made up their own rules. The whole of PKI should be ripped up and not left up to those who can shout loudest.

Re: Mozilla wants CAs to revoke 30 random certificates per year

#24

Post by agwa »

jonas21 wrote: post #21
agwa wrote: post #15

Earlier quoted context omitted.

Google Chrome also takes a hard line when it comes to revocation requirements, and Apple wants to limit certificate lifetimes to 45 days. Although neither have stated a position on random revocations, they are directionally aligned with Mozilla and you will be disappointed if you expect either of them to prioritize server operator convenience over the security of their users. As for Microsoft, they are simply asleep…

Don't you think there's a difference between having short certificate lifetimes (which would be clear when the certificate is issued), and randomly revoking perfectly good certificates without warning?

They are not literally the same, but the point of both measures is to encourage automation by server operators, and are strongly opposed by those who would prefer to keep managing certificates manually. My point is - Apple, like Mozilla, doesn't mind inconveniencing server operators if they see a security benefit for users.

(Also, the revocations would not be without warning - mechanisms like ARI can inform server operators prior to revocation so the certificate can be automatically replaced.)

Re: Mozilla wants CAs to revoke 30 random certificates per year

#26

Post by agwa »

ElevenLathe wrote: post #19
ForHackernews wrote: post #9

Earlier quoted context omitted.

>CA trust should be handled at the OS vendor level. Who's the "vendor" for Linux? IBM? The outcome of this idea is Google & Microsoft can MITM all internet traffic.

> Who's the "vendor" for Linux? IBM? There are countless companies and groups (but only a handful that serve the vast majority of users) releasing a version of Linux bundled with a GNU userland and other open source niceties, all designed to work together as a system. These are colloquially called "Linux distributions".

Linux distros universally use the Mozilla root store. So if a CA told Mozilla "to go pound sand" as suggested by likeabatterycar, the CA would end up distrusted not only by the "2.5%" of browser users, but by every Linux server.

Re: Mozilla wants CAs to revoke 30 random certificates per year

#27

Post by alyandon »

agwa wrote: post #15
likeabatterycar wrote: post #7

Earlier quoted context omitted.

To put things into perspective, the people behind the browser with The reality is the CAs could tell Mozilla to go pound sand and they would have no recourse. Is there not a governing body for certificate policies with voting members? CA trust should be handled at the OS vendor level. Mozilla having its own trust anchors is a relic of the past. If CAs refuse to comply, they at worst inconvenience 2.5% of their custom…

Google Chrome also takes a hard line when it comes to revocation requirements, and Apple wants to limit certificate lifetimes to 45 days. Although neither have stated a position on random revocations, they are directionally aligned with Mozilla and you will be disappointed if you expect either of them to prioritize server operator convenience over the security of their users. As for Microsoft, they are simply asleep…

Based on what I've seen internally at several $LARGE_CORPs, a 90 day expiration was more than painful enough to cause teams to invest in automation for rotation. I don't know that cutting 90 days to 45 days would help move the needle further.

Re: Mozilla wants CAs to revoke 30 random certificates per year

#28

Post by likeabatterycar »

alyandon wrote: post #27
agwa wrote: post #15

Earlier quoted context omitted.

Google Chrome also takes a hard line when it comes to revocation requirements, and Apple wants to limit certificate lifetimes to 45 days. Although neither have stated a position on random revocations, they are directionally aligned with Mozilla and you will be disappointed if you expect either of them to prioritize server operator convenience over the security of their users. As for Microsoft, they are simply asleep…

Based on what I've seen internally at several $LARGE_CORPs, a 90 day expiration was more than painful enough to cause teams to invest in automation for rotation. I don't know that cutting 90 days to 45 days would help move the needle further.

> I don't know that cutting 90 days to 45 days would help move the needle further.

What does this protect you from? If a private key is stolen from a device? If it went unnoticed for 45 days, the device is probably still compromised, and the threat actor will just steal the new key. If you can automate issuing certificates, you can automate stealing them too.

Sounds like a great way to garner more business for Big PKI.

Re: Mozilla wants CAs to revoke 30 random certificates per year

#29

Post by alyandon »

likeabatterycar wrote: post #28
alyandon wrote: post #27

Earlier quoted context omitted.

Based on what I've seen internally at several $LARGE_CORPs, a 90 day expiration was more than painful enough to cause teams to invest in automation for rotation. I don't know that cutting 90 days to 45 days would help move the needle further.

> I don't know that cutting 90 days to 45 days would help move the needle further. What does this protect you from? If a private key is stolen from a device? If it went unnoticed for 45 days, the device is probably still compromised, and the threat actor will just steal the new key. If you can automate issuing certificates, you can automate stealing them too. Sounds like a great way to garner more business for Big PK…

It mainly helps with stuff like enforcing modern tls + ciphers and various other changes that occur naturally in the ecosystem over time.

You are not wrong about the malware part though. Said undetected malware would continue to be undetected and continue to expose the private bits no matter how (in)frequently you rotate.

Re: Mozilla wants CAs to revoke 30 random certificates per year

#30

Post by gruez »

alyandon wrote: post #29
likeabatterycar wrote: post #28

Earlier quoted context omitted.

> I don't know that cutting 90 days to 45 days would help move the needle further. What does this protect you from? If a private key is stolen from a device? If it went unnoticed for 45 days, the device is probably still compromised, and the threat actor will just steal the new key. If you can automate issuing certificates, you can automate stealing them too. Sounds like a great way to garner more business for Big PK…

It mainly helps with stuff like enforcing modern tls + ciphers and various other changes that occur naturally in the ecosystem over time. You are not wrong about the malware part though. Said undetected malware would continue to be undetected and continue to expose the private bits no matter how (in)frequently you rotate.

>It mainly helps with stuff like enforcing modern tls + ciphers and various other changes that occur naturally in the ecosystem over time.

???

why would you need to issue new certificates for "enforcing modern tls + ciphers and various other changes"? There's nothing preventing you from using a newly minted letsencrypt certificate with sslv3, for instance.

Post reply on HN