Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

F-Droid site certificate expired

gitlab.com

Post reply on HN
Print view View original

41–50 of 115 posts

Re: F-Droid site certificate expired

#41

Post by tialaramex »

ocdtrekkie wrote: post #33
lukeschlather wrote: post #31

Earlier quoted context omitted.

The only one of those things that is the fault of ACME is the first one, and are you really suggesting between that and your second bullet point that we should charge money for encryption so that people value it more? Encryption is free so people do it more. Paying money doesn't actually make people trustworthy. (Though you can totally charge people to prove they aren't malicious, but if you want to do that, why tie…

> Paying money doesn't actually make people trustworthy. This is fundamentally a naive understanding of both security and certificates. Paying money absolutely makes people trustworthy because it's prohibitive to do it at scale. You might have one paid malicious certificate but you can have thousands of free ones. The one malicious domain gets banned, the thousands are whack-a-mole forever. Further, certificates used…

It didn't take a "big PR campaign". EV is crap. It was crap when it was created, it's still crap now. It was tolerated because the commercial CAs wanted a new shinier product and in exchange we got the BRs and from there we got here. Don't lean on EV, it's superficial not load bearing.

I don't much care about BIMI. People keep trying to resuscitate that particular dead dog (email security), maybe one day they will succeed but I don't expect to be involved.

Re: F-Droid site certificate expired

#42

Post by bstsb »

tomsmeding wrote: post #39
SillyUsername wrote: post #37

[flagged]

Honestly, someone coming in unasked and trying to get you on the free plan of their own product, is kind of rude.

ehh i think it's different when they're offering an otherwise paid service specifically for open-source projects. like Cloudflare with Project Alexandria

Re: F-Droid site certificate expired

#44

Post by ozim »

crazygringo wrote: post #21
ozim wrote: post #17

Earlier quoted context omitted.

There are new solutions for CRL just last month: https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...

Yup. If your primary goal was fast, efficient certificate revocation, then having certs that still take 90 days to expire rather than 2 years is not the solution you'd come up with. CRLite updates every 12 hours .

If you have short validity times for certificates it also means you have shorter CRL.

Re: F-Droid site certificate expired

#47

Post by TedDoesntTalk »

m-p-3 wrote: post #16
crazygringo wrote: post #8

Earlier quoted context omitted.

You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire. However, short expirations severely limit the damage an attacker can do if they steal your private key. And they avoid the situations where an organization simply forgets to renew a cert, because automating something so infrequent is genuinely difficult from an organizational standpoint…

CRLs are becoming bulky, and OCSP have some privacy implications (telling the CA which websites you visit), plus most browsers are set to soft fail if there's an outage and the request can't be made instead of a hard fail and making the website inaccessible, reducing the security and usefulness of OCSP. Short-lived certificates fixes these issues from an end-user standpoint.

Is it possible that one day certificate expiration will be a thing of the past?

Re: F-Droid site certificate expired

#49

Post by aaomidi »

ocdtrekkie wrote: post #34
aaomidi wrote: post #22

Earlier quoted context omitted.

You’re just moving your root of trust to DNS then? With certificates we’re doing multi perspective validation. DNS root of trust is silly. DNSSEC is not a proper root of trust

DNS is already the root of trust, certificates are domain-validated. We currently just depend on both DNS and an unelected group of random companies Google has decided jump through their arbitrary hoops often enough. If your domain register or DNS provider is compromised in any way, all of the bullcrud the CA/B demands of certificates is entirely meaningless, the bad actor can legitimately request certificates.

This is what multi perspective helps with. It doesn’t mitigate every single attack.

But think about what DANE is for a second. If a bad actor is MITMing your connection to some endpoint, they certainly can MITM your DNS queries too.

Re: F-Droid site certificate expired

#50

Post by ocdtrekkie »

aaomidi wrote: post #49
ocdtrekkie wrote: post #34

Earlier quoted context omitted.

DNS is already the root of trust, certificates are domain-validated. We currently just depend on both DNS and an unelected group of random companies Google has decided jump through their arbitrary hoops often enough. If your domain register or DNS provider is compromised in any way, all of the bullcrud the CA/B demands of certificates is entirely meaningless, the bad actor can legitimately request certificates.

This is what multi perspective helps with. It doesn’t mitigate every single attack. But think about what DANE is for a second. If a bad actor is MITMing your connection to some endpoint, they certainly can MITM your DNS queries too.

Multi-perspective helps prevent MITM, it doesn't provide any better security than your domain and DNS provider's security. It's just another layer to patch over the bad idea of CAs in the first place.
Post reply on HN