Live data from Hacker News

The Impending Doom of Expiring Root CAs and Legacy Clients

scotthelme.co.uk

201–209 of 209 posts

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#201
post #17

Earlier quoted context omitted.

It's a good point. At any given time, the key is either compromised or it's not. And you may or may not know either way. If it's compromised, and you know, then it should be revoked -- if your only mechanism to revoke it is waiting some amount of time (several days, months, or even a decade) you have a pretty big problem. If you don't have a way to detect if it's compromised, rotating a precaution almost makes sense…

I'd say sign the next root certificate with previous root key, then you can rotate root key automatically. Browser update works the same way: you download new browser with new root certificate authenticated by previous root key.

Most roots are required to be cross-signed today by all the major browser and OS vendors. What you have is a classic web of trust issue because it's the new key that has the signatures attached so you could take the new key/certificate at its word, but if the problem is the previous root expiring, how do you trust that the new root certificate was signed by the previous root before it expired? You can't trust the now expired root can you? If you restrict it to the subset of time where both roots are unexpired, you have the exact same problem as the intermediate game that the BBC has to play in the article.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#202
post #4

Earlier quoted context omitted.

What we did for our old tv, was to get a chromecast after 3-4 years. This might be a cheaper and more environmentally friendly approach than yours, as we then buy one «smart-device», but you might end up with 2, over 12 years. But then some (all?) smart tv offerings have issues with terms and conditions, privacy, etc which may make them undesirable for you.

Pro-tip: you can usually un-accept privacy policies on Smart TVs and this reverts them to "dumb" TVs. This disables built-in apps and may make "software updates" unavailable but that's actually what you want anyway.

How would I do this?

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#203

Earlier quoted context omitted.

I'd say sign the next root certificate with previous root key, then you can rotate root key automatically. Browser update works the same way: you download new browser with new root certificate authenticated by previous root key.

Most roots are required to be cross-signed today by all the major browser and OS vendors. What you have is a classic web of trust issue because it's the new key that has the signatures attached so you could take the new key/certificate at its word, but if the problem is the previous root expiring, how do you trust that the new root certificate was signed by the previous root before it expired? You can't trust the now…

Same as with the browser update: you receive it before the previous certificate expired.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#204
post #50

Earlier quoted context omitted.

> ... I wanted a 4K monitor. To all the folks reading at home... I would remind everyone that a TV is not a monitor. I got a relatively inexpensive LG 43in TV to use as a desktop monitor. I've had issues. Beyond the usual "make sure your graphics card actually supports 4K" and such, you also need to take some time to dig through the TV settings when you are using it on a PC. In particular, you definitely want to turn…

As a side note, if you want to watch 4K video, keep in mind that as of right now, _the_ main draw of 4K is HDR (most 4K video out there is upscaled), and most cheaper 4K screens (both TVs and monitors) don't support HDR. Or if they claim they do, they only "support" HDR in that the monitor does tonemapping in hardware but can't render HDR colors. The technology is still new enough that getting the cheapest 4K screen…

I really don't understand 4K 10bit HDR video that's still only 29 FPS. Why is smooth motion not a focus at all?

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#205

"Impending" doom? Devices from 10 years ago are _already_ useless online. Not only are the root certificates completely expired, but let's see which protocols does an openssl 0.9.8 build from a decade ago have in common with, say, current Gmail's IMAPS server: NONE.

I am really conflicted when configuring my servers. I can see the need to deprecate insecure protocols but deliberately cutting off compatibility with old clients feels wrong.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#206

Earlier quoted context omitted.

Pro-tip: you can usually un-accept privacy policies on Smart TVs and this reverts them to "dumb" TVs. This disables built-in apps and may make "software updates" unavailable but that's actually what you want anyway.

How would I do this?

It's buried in settings. On samsung it's in system settings.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#207

Earlier quoted context omitted.

Most roots are required to be cross-signed today by all the major browser and OS vendors. What you have is a classic web of trust issue because it's the new key that has the signatures attached so you could take the new key/certificate at its word, but if the problem is the previous root expiring, how do you trust that the new root certificate was signed by the previous root before it expired? You can't trust the now…

Same as with the browser update: you receive it before the previous certificate expired.

Most of this article is about the pain caused by that we cannot assume devices will update in years. There's no window you can set for both certificates to be valid side-by-side that will be long enough to update every device.

Again, roots are already cross-signed and the article points out they still take 2+ years to pass other validity checks for root adoption. Even if they "virally" propagated in this manner after all those checks passed, there are plenty of devices that are only powered on once a year or less; there are a lot of devices whose support lifetimes for any upgrades at all are less than 2 years (that's a specific call in the article: we need security support lifetimes extended to decades at least, probably).

If they propagate "virally" you have a lot of questions of whether or not a device will even see that there is an updated certificate. Not every user or device visits a web page in a certificate chain to any given root routinely much less ever.

Comments to this article even point out that there is a semi-viral update process already in place in most browsers called AIA chasing, where certificates may point to URLs to look up their parent authorities, and Mozilla intentionally doesn't AIA chase because it's very definitely a privacy risk, even if you don't agree that it is a security risk (bad certificates sending you to bad URLs). The security risk is why the browsers that do AIA chasing only allow it for intermediate certificates and will not trust new roots found by AIA chasing.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#208

Once again the persuit of security theater to meet the requirements of commerce (which most of the web doesn't share) cause problems accessing the large parts of the normal web. When are people going to learn that centralized cert authorities are just for commerce and only hurt the non-commercial web?

Curious - what do you suggest for non-commercial web, taking into account both privacy and security?

If those are your motivations then making the site accessible as an onion service over tor in addition to the http interface (and https self signed) seems reasonable.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#209
post #23
post #15

Earlier quoted context omitted.

I purposely bought and expensive one that’s pure android tv where you can disable all the tracking bits

You bought an Android device to avoid tracking? lol As long as you're using binaries that were compiled by Google I wouldn't trust them one bit. If you use LineageOS on your TV you might be a little better off.

Android by Sony verses Samsung or webos? I’m happy with my choice.
Post reply on HN