Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla wants CAs to revoke 30 random certificates per year

groups.google.com

Post reply on HN
Print view View original

31–36 of 36 posts

Re: Mozilla wants CAs to revoke 30 random certificates per year

#31

Post by gruez »

likeabatterycar wrote: post #20
nimish wrote: post #12

This is classic "we don't have a purpose so let's cause problems" thinking. WTF!!

It's not even the most insane suggestion in the thread. That would be the proposal to require ACME for all certificates. So all your appliances with manual cert installation and devices without direct connection to the internet would break.

>That would be the proposal to require ACME for all certificates. So all your appliances with manual cert installation and devices without direct connection to the internet would break.

Technically ACME supports challenges that work without "direct connection to the internet", eg. DNS.

Re: Mozilla wants CAs to revoke 30 random certificates per year

#32

Post by alyandon »

gruez wrote: post #30
alyandon wrote: post #29

Earlier quoted context omitted.

It mainly helps with stuff like enforcing modern tls + ciphers and various other changes that occur naturally in the ecosystem over time. You are not wrong about the malware part though. Said undetected malware would continue to be undetected and continue to expose the private bits no matter how (in)frequently you rotate.

>It mainly helps with stuff like enforcing modern tls + ciphers and various other changes that occur naturally in the ecosystem over time. ??? why would you need to issue new certificates for "enforcing modern tls + ciphers and various other changes"? There's nothing preventing you from using a newly minted letsencrypt certificate with sslv3, for instance.

Sure, I misspoke. It's more about the contents of the cert itself (signing keys, deprecation of CN field, etc) than the hosting web server configuration.

Obviously, one can actively choose to go out of their way and do something bone-headed - nothing can stop that.

Re: Mozilla wants CAs to revoke 30 random certificates per year

#33

Post by WorldMaker »

agwa wrote: post #24
jonas21 wrote: post #21

Earlier quoted context omitted.

Don't you think there's a difference between having short certificate lifetimes (which would be clear when the certificate is issued), and randomly revoking perfectly good certificates without warning?

They are not literally the same, but the point of both measures is to encourage automation by server operators, and are strongly opposed by those who would prefer to keep managing certificates manually. My point is - Apple, like Mozilla, doesn't mind inconveniencing server operators if they see a security benefit for users. (Also, the revocations would not be without warning - mechanisms like ARI can inform server op…

It's also a part of why Let's Encrypt exists as a market force from the other side of this playing field. Now that they've proven heavy automation works and shown they can use it to drive costs down, Apple and Mozilla don't look so crazy asking for the old, expensive behemoths to move faster/smarter/better.

Re: Mozilla wants CAs to revoke 30 random certificates per year

#35

Post by hulitu »

likeabatterycar wrote: post #20
nimish wrote: post #12

This is classic "we don't have a purpose so let's cause problems" thinking. WTF!!

It's not even the most insane suggestion in the thread. That would be the proposal to require ACME for all certificates. So all your appliances with manual cert installation and devices without direct connection to the internet would break.

Better make any certificate expire after 20ms. Slow internet ? Bad luck. /s

Re: Mozilla wants CAs to revoke 30 random certificates per year

#36

Post by ForHackernews »

likeabatterycar wrote: post #11
ForHackernews wrote: post #9

Earlier quoted context omitted.

>CA trust should be handled at the OS vendor level. Who's the "vendor" for Linux? IBM? The outcome of this idea is Google & Microsoft can MITM all internet traffic.

> The outcome of this idea is Google & Microsoft can MITM all internet traffic. Google, MS, and Apple already handle their own CA trust. So this conspiracy theory would already be true.

Wait, is it a "conspiracy theory" or is it true? Are you claiming both? I'm aware that Google, Apple, Microsoft etc. could already MITM traffic to Chrome/Safari/Edge browsers if they were so determined.
Post reply on HN