Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lavabit SSL Cert Revoked

lavabit.com

Post reply on HN
Print view View original

41–50 of 321 posts

Re: Lavabit SSL Cert Revoked

#41

Post by [deleted] »

spindritf wrote: post #33
briansmith wrote: post #27

Earlier quoted context omitted.

Firefox treats an explicit "unknown" OCSP status as equivalent to being revoked, except we don't cache the "unknown" status. Firefox doesn't allow the user to override "revoked." The thinking behind our cert error override strategy is that cert error overrides are intended mostly to allow the user to fix something that is probably supposed to work, but a revocation is a very explicit signal that the certificate isn't…

Thanks for answering. Yes, I have it unchecked. Is there some about:config magic or "kamikaze mode" that I could enable that would allow me to ignore at least outdated certs? Last night I locked myself out of my own website. The old cert expired and the OCSP server didn't know about the new one yet.

[deleted]

Re: Lavabit SSL Cert Revoked

#42

Post by briansmith »

spindritf wrote: post #33
briansmith wrote: post #27

Earlier quoted context omitted.

Firefox treats an explicit "unknown" OCSP status as equivalent to being revoked, except we don't cache the "unknown" status. Firefox doesn't allow the user to override "revoked." The thinking behind our cert error override strategy is that cert error overrides are intended mostly to allow the user to fix something that is probably supposed to work, but a revocation is a very explicit signal that the certificate isn't…

Thanks for answering. Yes, I have it unchecked. Is there some about:config magic or "kamikaze mode" that I could enable that would allow me to ignore at least outdated certs? Last night I locked myself out of my own website. The old cert expired and the OCSP server didn't know about the new one yet.

Interesting. Normally we allow users to override "expired."

Was the OCSP server returned "unknown" for the old cert after it expired? One way to check this would be to uncheck the first check box in that dialog box ("Use OCSP"). If you are able to override the cert error for the expired cert then that is a good indication that the server is returning "unknown" for expired certs.

If "unknown" response for the expired cert is the cause, this is the law of unintended consequences at work. Previously, it was very common for a CA's OCSP responder to return "good" for any certificate that it didn't know about; i.e. their OCSP responders returned "revoked" for every certificate that they knew was revoked, but "good" by default. After the DigiNotar incident, we (Mozilla and other browser vendors) pushed CAs to change the default to be "unknown."

However, it is also fair for the CA to "forget" about a certificate as soon as it has expired and/or to revoke it as soon as it has expired. If so, the OCSP responder would return "revoked" or "unknown" for any expired certificate. That would turn a user-overridable error (expired) into a non-user-overridable error (revoked/unknown). This is something we hadn't considered.

Certificate authorities need to be careful that they update their OCSP responders ASAP, preferably BEFORE they give the customer the cert, to avoid this issue in the newly-issued certificate case. Because many CAs have just recently implemented this policy of returning "unknown" for unknown certs, there are still some bugs to sort out, I guess. I will bring this up in the CA/Browser forum to make sure everybody knows it is a real-world issue.

Re: Lavabit SSL Cert Revoked

#43

Post by mpyne »

miketucker wrote: post #6
WestCoastJustin wrote: post #3

Can someone weight in on what this means or why it is an issue?

Today the owner, Ladar Levison, had to hand over the SSL certificates by court order. It marks the ending of a long battle in court, with unfortunately it ending in the govenment's favor. I'm assuming the post is just a hacker way of acknowledging the event. Related article: http://www.newyorker.com/online/blogs/elements/2013/10/how-l...

Interesting link, and much more informative than the other Lavabit news articles.

It's a shame the government didn't work with Levison to either allow Levison to add the requested intercept himself (which, yes, would have required Uncle Sam to trust him) or to allow a third-party (or even a third party requested from both sides) to audit the proposed interception code.

The judge is correct in stating that if Levison doesn't trust the government, then why should the government trust Levison, but Levison is clearly correct when he notes that giving up his SSL private keys would destroy the security of his whole infrastructure.

The government would have been far better off by allowing a service like Lavabit to exist with the cooperation of an activist citizen than to force him to either harm all of his customers or shutdown the service. Somehow I don't think the D.A. here realized how serious many civil libertarians are.

Props on Levison for trying to stick it out in the U.S. and make things better from within!

Re: Lavabit SSL Cert Revoked

#45

Post by scott_karana »

interstitial wrote: post #40
rebelidealist wrote: post #35

Consider donating to https://rally.org/lavabit . Lavabit needs at least 250k to continue fighting in the supreme court. See his last update on the rally page.

And our contribution becomes part of our "permanent record" with the NSA? So glad I'm a US citizen and need not fear about such things.

That just sounds like fearmongering. I can't see any way that helping to fund someone's court case can be considering a crime, even if he were completely in the wrong.

I strongly suspect that there are favourable legal precedents, even.

Re: Lavabit SSL Cert Revoked

#47

Post by kyboren »

scott_karana wrote: post #45
interstitial wrote: post #40

Earlier quoted context omitted.

And our contribution becomes part of our "permanent record" with the NSA? So glad I'm a US citizen and need not fear about such things.

That just sounds like fearmongering. I can't see any way that helping to fund someone's court case can be considering a crime, even if he were completely in the wrong. I strongly suspect that there are favourable legal precedents, even.

Non-citizens can be turned away at the US border for any reason, or no reason at all.

Considering that a person's ability to travel to the US is so professionally important in this industry (for conferences, business meetings, etc.), I do not believe this is fearmongering.

Remember the case of the man refused entry after a misinterpreted Tweet about 'destroying America'? [1] It seems clear NSA surveillance informs CBP's entry decisions in at least some cases. Credit card payments are surely surveilled by NSA, so this actually sounds like a pretty well-grounded fear.

[1]: http://www.nbclosangeles.com/news/local/British-Tourists-Den...

Re: Lavabit SSL Cert Revoked

#48

Post by shocks »

powertower wrote: post #39
chris_mahan wrote: post #31

Earlier quoted context omitted.

Following that line of reasoning down the slimy slippery slope, developing better encryption systems could be construed as obstruction of justice, no?

No.

This is exactly the point he was trying to make...

Re: Lavabit SSL Cert Revoked

#49

Post by bootstampface »

spindritf wrote: post #22

I cannot ignore this warning in Firefox 24 from official repository on Ubuntu 13.04. Actually, I cannot ignore outdated certificates, or those with unknown OCSP status (for example freshly issued certs) either. Was there some change in Firefox's security model or is it my config? It's rather annoying.

This brings up an important issue.

If you're able to access OPs link unhindered, you need to investigate your cert handling.

Re: Lavabit SSL Cert Revoked

#50

Post by jamesaguilar »

anologwintermut wrote: post #34
jtdowney wrote: post #25

Earlier quoted context omitted.

The site currently negotiates for DHE-RSA-AES256-SHA, which is forward secure.

Right. But if you connect with a browser that doesn't support that? And what about SMTP connections?

Presumably if you care about security you are using a browser that does PFS and have personally verified that it is working.
Post reply on HN