Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

F-Droid site certificate expired

gitlab.com

Post reply on HN
Print view View original

31–40 of 115 posts

Re: F-Droid site certificate expired

#31

Post by lukeschlather »

justsomehnguy wrote: post #29
tgsovlerkhgsel wrote: post #27

Earlier quoted context omitted.

Meanwhile, in the real world: - We went from the vast majority of traffic being unencrypted, allowing any passive attacker (from nation state to script kiddie sitting in the coffee shop) to snoop and any active attacker to trivially tamper with it, to all but a vanishing minority of connections being strongly encrypted. The scare tactics used to sell VPNs in YouTube ads used to all be true, and no longer are, due to…

Meanwhile, in the real world: - We now provide a completely free certs for a malicious web-sites - Degraded encryption value so much it's not even indicated anymore (remember the green bar for EV?) - Pavlov-trained everyone to dumb-click through 'this page is not secure' warnings - SNI exists and even without it anything not on CDN is blocked very easily

The only one of those things that is the fault of ACME is the first one, and are you really suggesting between that and your second bullet point that we should charge money for encryption so that people value it more? Encryption is free so people do it more. Paying money doesn't actually make people trustworthy. (Though you can totally charge people to prove they aren't malicious, but if you want to do that, why tie it to encryption? Encrypt regardless.)

Re: F-Droid site certificate expired

#32

Post by prmoustache »

justsomehnguy wrote: post #29
tgsovlerkhgsel wrote: post #27

Earlier quoted context omitted.

Meanwhile, in the real world: - We went from the vast majority of traffic being unencrypted, allowing any passive attacker (from nation state to script kiddie sitting in the coffee shop) to snoop and any active attacker to trivially tamper with it, to all but a vanishing minority of connections being strongly encrypted. The scare tactics used to sell VPNs in YouTube ads used to all be true, and no longer are, due to…

Meanwhile, in the real world: - We now provide a completely free certs for a malicious web-sites - Degraded encryption value so much it's not even indicated anymore (remember the green bar for EV?) - Pavlov-trained everyone to dumb-click through 'this page is not secure' warnings - SNI exists and even without it anything not on CDN is blocked very easily

What is stupid is not to provide free certs for malicious web sites, what was stupid is telling people for years that they would be safe and could trust a website only because there was a lock icon on the url bar.

Re: F-Droid site certificate expired

#33

Post by ocdtrekkie »

lukeschlather wrote: post #31
justsomehnguy wrote: post #29

Earlier quoted context omitted.

Meanwhile, in the real world: - We now provide a completely free certs for a malicious web-sites - Degraded encryption value so much it's not even indicated anymore (remember the green bar for EV?) - Pavlov-trained everyone to dumb-click through 'this page is not secure' warnings - SNI exists and even without it anything not on CDN is blocked very easily

The only one of those things that is the fault of ACME is the first one, and are you really suggesting between that and your second bullet point that we should charge money for encryption so that people value it more? Encryption is free so people do it more. Paying money doesn't actually make people trustworthy. (Though you can totally charge people to prove they aren't malicious, but if you want to do that, why tie…

> Paying money doesn't actually make people trustworthy.

This is fundamentally a naive understanding of both security and certificates. Paying money absolutely makes people trustworthy because it's prohibitive to do it at scale. You might have one paid malicious certificate but you can have thousands of free ones. The one malicious domain gets banned, the thousands are whack-a-mole forever.

Further, certificates used to indicate identity in more than a "the domain you are connected to" sense. There was a big PR campaign to wreck EV certs but EV certs generally were extremely secure. And even Google, who most loudly complained about EV, has reintroduced the Verified Mark Certificate (VMC) to replace it and use for new things like BIMI.

Re: F-Droid site certificate expired

#34

Post by ocdtrekkie »

aaomidi wrote: post #22
hkt wrote: post #14

Earlier quoted context omitted.

DANE would be better than LE, but weirdly the massive companies building browsers don't want to provide support. Spooky! https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...

You’re just moving your root of trust to DNS then? With certificates we’re doing multi perspective validation. DNS root of trust is silly. DNSSEC is not a proper root of trust

DNS is already the root of trust, certificates are domain-validated. We currently just depend on both DNS and an unelected group of random companies Google has decided jump through their arbitrary hoops often enough.

If your domain register or DNS provider is compromised in any way, all of the bullcrud the CA/B demands of certificates is entirely meaningless, the bad actor can legitimately request certificates.

Re: F-Droid site certificate expired

#35

Post by nozzlegear »

justsomehnguy wrote: post #29
tgsovlerkhgsel wrote: post #27

Earlier quoted context omitted.

Meanwhile, in the real world: - We went from the vast majority of traffic being unencrypted, allowing any passive attacker (from nation state to script kiddie sitting in the coffee shop) to snoop and any active attacker to trivially tamper with it, to all but a vanishing minority of connections being strongly encrypted. The scare tactics used to sell VPNs in YouTube ads used to all be true, and no longer are, due to…

Meanwhile, in the real world: - We now provide a completely free certs for a malicious web-sites - Degraded encryption value so much it's not even indicated anymore (remember the green bar for EV?) - Pavlov-trained everyone to dumb-click through 'this page is not secure' warnings - SNI exists and even without it anything not on CDN is blocked very easily

> Pavlov-trained everyone to dumb-click through 'this page is not secure' warnings

Do we have any statistics for how many people are actually doing this? Such warnings are so rare in my experience that, by default, I don't trust a site that has no SSL/expired or invalid certs and won't click through if I see that warning.

Re: F-Droid site certificate expired

#36

Post by [deleted] »

tgsovlerkhgsel wrote: post #27
shaky-carrousel wrote: post #5

Earlier quoted context omitted.

It is, if your objective is to closely centralize the web. If you make https mandatory, via scare tactics, only people with certificates will have websites. If you make ephemeral certificates mandatory by taking advantage of a monopoly, then only big SSL providers who can afford it will survive. Then, when you have only two or three big SSL providers, it's way easier to shut someone off by denying them a certificate,…

Meanwhile, in the real world: - We went from the vast majority of traffic being unencrypted, allowing any passive attacker (from nation state to script kiddie sitting in the coffee shop) to snoop and any active attacker to trivially tamper with it, to all but a vanishing minority of connections being strongly encrypted. The scare tactics used to sell VPNs in YouTube ads used to all be true, and no longer are, due to…

[deleted]

Re: F-Droid site certificate expired

#38

Post by ozim »

aaomidi wrote: post #25
ozim wrote: post #18

Earlier quoted context omitted.

CRL doesn’t suck it is just not easy problem on web scale. But seems like there is feasible solution: https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...

AKA they suck in this context

Was CRL designed with this context in mind?

Re: F-Droid site certificate expired

#40

Post by tbrownaw »

crazygringo wrote: post #8
shaky-carrousel wrote: post #5

Earlier quoted context omitted.

It is, if your objective is to closely centralize the web. If you make https mandatory, via scare tactics, only people with certificates will have websites. If you make ephemeral certificates mandatory by taking advantage of a monopoly, then only big SSL providers who can afford it will survive. Then, when you have only two or three big SSL providers, it's way easier to shut someone off by denying them a certificate,…

You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire. However, short expirations severely limit the damage an attacker can do if they steal your private key. And they avoid the situations where an organization simply forgets to renew a cert, because automating something so infrequent is genuinely difficult from an organizational standpoint…

> You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire.

But that's an explicit action that's much simpler to ask questions about.

Post reply on HN