Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

341–350 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#341

Post by loeg »

zozbot234 wrote: post #223
loeg wrote: post #211

Earlier quoted context omitted.

The mechanism SSH uses is called Trust on First Use ("TOFU") and is closer to what used to be HTTPS certificate pinning. In this scheme, certificates never expire, and if they do, clients warn about the unexpected change in certificate. It is different from the CA PKI system, where the client trusts any certificate signed by a trusted CA without prompting the user at all, and doesn't prompt the user if the certificat…

Self-signed certificates give you basically this. It's a bit of a hassle to mark them as trusted, but you only have to do it once.

That has not been my experience with current versions of Chrome.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#342

Post by robocat »

heavenlyblue wrote: post #163
AdamJacobMuller wrote: post #139

Earlier quoted context omitted.

I'm not a huge fan of it, but, it seems like the way things are going is to simply run a service which is basically a large proxy. Your device connects out with some kind of persistent connection to their central service then requests to your device go to their server, which does AAA and routes to your local device. Fixes the SSL issue, avoids any NAT headaches, enables fully remote access and most importantly for PM…

I would be happy if my router supported letsencrypt. Why would I even bother copying and distributing self-signed certificates if I can just properly get a certificate for my own personal router? It’s idiotic that people still trust pure HTTP and have no option of switching.

If your router needs configuring before it can access the Internet, then it can’t use certificates that require the internet to generate or validate.

Or if you change ISP and need to change your router internet connection configuration, your router cannot be accessed.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#343

Post by imtringued »

CountSessine wrote: post #311
Spivak wrote: post #269

Earlier quoted context omitted.

I mean if they’re worthless tunnels then so is every SSH tunnel. Should we just go back to telnet?

On your own network? Does it really matter whether you use telnet or ssh? And if it’s on a shared network, don’t you have an IT department that can set up the local key infrastructure and push out certificates? The argument here is that we should enable lots of shitty IoT devices to masquerade as being secure, and inure browser users to click ‘yes’ to accepting a broken certificate. If it’s on a managed network, IT c…

Ok we can always use HTTP instead. I personally hate how using HTTPS gets harder and harder every single year.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#344

Post by imtringued »

Spivak wrote: post #271
paledot wrote: post #213

Earlier quoted context omitted.

There are two options: * Manually install a root certificate, which is a confusing process for most end users and a non-starter for anyone who cares about security. (Imagine walking your parents through the process.) * Trust a self-signed certificate, which is an increasingly difficult and counterintuitive process since Chrome and Firefox started competing to see who could destroy their usefulness faster. I'm not eve…

I mean I’m not sure if there’s a solution that will make everyone happy then. Making trusting self-signed cheers easy and not scary has real security implications because users just click-through warnings.

Making casual users create their own root certificates sounds like an even worse problem. Now an attacker isn't restricted to impersonating your lightbulbs. They can impersonate any domain if they can get your private CA. Now imagine if an IoT vendor engages in questionable practices like creating the CA for you and the user only has to download an exe that automatically installs the root certificate. The benefit for the vendor would be that all devices you order from their website would be shipped with correctly signed https certificates. Later a hacker dumps the database with root CAs and uses it to impersonate your bank.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#345

Post by imtringued »

slenk wrote: post #334
orev wrote: post #186

Earlier quoted context omitted.

I get the feeling you have no real experience either running a company network or dealing with end users and home networks. Any of these solutions work fine for a majority of people who just use their laptop in Starbucks, but they really break down when you need to start doing anything more complicated than that.

Please, educate me as to what I am overlooking. The requirements of buying a domain name and getting a LE wildcard cert should be trivial to someone with the experience you seem to have.

Why would the average customer of IoT products have the same expertise as the person you are replying to?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#346

Post by imtringued »

dimensi0nal wrote: post #76
xg15 wrote: post #66

Earlier quoted context omitted.

Without buying a domain. (and continously spending money to keep it owned)

A .net is 83 cents a month.

That's usually a limited special offer. Not everyone wants to change domains every year.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#347

Post by imtringued »

brian-bk wrote: post #219
superkuh wrote: post #120

Earlier quoted context omitted.

That's me! I'm technical enough to self-sign for ssl for my sites (it and tor are what I do instead) but I run on lots of old hardware and old (>5 years) OSes. The tools for constantly re-updating letsencrypt simply don't work and all the containerizations didn't exist yet. I've tried nearly a dozen LetsEncrypt updates solutions, compiled from source, from debs, "standalone" only bash solutions, etc, there's always a…

Are those >5 year OSes receiving security patches?

They probably receive more security patches than Centos 8 and by that I mean Centos 8 is lagging behind.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#348

Post by imtringued »

brian-bk wrote: post #178
markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

> It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. If you want to run a webserver but are unable to set up a cronjob that does certbot renew you don't deserve external users. Full stop. If it's just you and you don't care about your own security, then do whatever you want in your own browser.

I have tried to look at the documentation for certbot and the amount effort they put into optimizing the fastpath makes it incredibly difficult to do things manually. The documentation is absolutely awful. Certbot uses .pem files which are practically useless to any JVM based application. So now you got to add your --deploy-hook and add a custom script to convert everything. Don't use any of the blessed DNS providers? Again write your own authentication and cleanup hooks. Suddenly your simple certbot setup involves 3 different scripts that have to be tailored to your specific situation. Sure there are nice blog posts that go through the entire thing but the official documentation basically pretends that your use case doesn't even exist because everyone is running Apache and Nginx, right guys?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#349

Post by jt2190 »

lvh wrote: post #127
jt2190 wrote: post #102

Earlier quoted context omitted.

There’s always the .local TLD, which is reserved for this use case: https://en.m.wikipedia.org/wiki/.local

That works, but you can't get public certs for it, because you can't prove you own that domain (indeed, you don't :))

Please remind me where I said anything about public certificates. ;-)

xg15 is going to have to run a self-hosted Certificate Authority (CA) and generate certificates himself.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#350

Post by GordonS »

CydeWeys wrote: post #230
greatgib wrote: post #136

Remember the good old time when it was not an almighty cartel of browsers that controlled your internet? This is so an arbitrary decision and so much a pain in the ass. Again, a limited number of people used their corporate interests to decide for the whole world with almost no discussion. The worst is that the "security" argument for this change is quite weak. Yes, we can think that shorter certificates are a little…

I'm surprised to see this as the highest comment on this post. This is a clear security win, and thus good for users. And no, I don't trust websites to have my best interests in mind, not remotely. Hell, if browsers hadn't started warning about insecure connections then I suspect that even to this day most websites would still be insecure. We used to leave it up to the choice of each website, and that was a clear fai…

I agree with you about publicly available websites, but I'm not convinced this policy makes sense for IoT devices, especially for ones that aren't connected to the internet.
Post reply on HN