Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS 18 breaks IMAPS self-signed certs

forums.developer.apple.com

Post reply on HN
Print view View original

51–60 of 157 posts

Re: iOS 18 breaks IMAPS self-signed certs

#51

Post by lxgr »

User11110 wrote: post #50
lxgr wrote: post #46

Earlier quoted context omitted.

It really only is for bad practical reasons, that all coincidentally make it harder and harder to self-host stuff locally without paying a few dollars a month or year here and there to various rent seekers. "Just use Letsencrypt" really is the correct answer for 99% of use cases, but good luck if you find yourself with one from the 1%. You'll get an army of people mindlessly parroting "best practices" and will assume…

Internal CAs and self signed certificates are different. You can still generate a CA, sign your certificates, import your own CA into your phone and have that verify your certificates. You don't need Letsencrypt. But you'll learn in time.

Thanks for the condescension, but I know how to do all of this. I've done it before. And because of that, I can first hand attest that it's way too complicated.

No non-sophisticated user is able to run their own local CA, and that's why their NAS, IoT setup etc. all run over HTTP only, which in turn has implications for available web APIs (thanks to "secure origin only" policies and no exemption for local IPs/zeroconf domains) and many other things.

It also doesn't work for at least modern Android apps, since Android no longer makes user-provided CA certificates available to (non-browser) apps anymore, I believe, unless they're compiled with a special debugging parameter. On iOS it's still possible, but I'm not sure how long it's going to stay that way.

Re: iOS 18 breaks IMAPS self-signed certs

#52

Post by stephenmac98 »

lxgr wrote: post #44
stephenmac98 wrote: post #14

It's 2024, PKI best practices are well known and well documented, anybody still using a self-signed certs on their mail server (or anywhere) is either lazy or stupid. Plenty of existing applications will refuse to connect to a self-signed certificate on the belief that allowing the end-user to confirm a certificate offers basically 0 protection against malicious actors.

Or is operating a local-only mailserver not connected to the larger internet? I guess that's a lazy or stupid thing too, these days... I'm a fan of having TLS on by default for everything on the Internet, but I'm seriously annoyed by the collateral damage to local self-hosted services the implementation of that has caused. It shouldn't be this hard to e.g. host web server on my local network that browsers grace with…

You have to consider the rarity of your use case vs the use case they're defending against.

How often do you think someone tries to connect their gamepad to a local server? Not never, but the total amount of users doing it is probably high tens or low hundreds at most

Compare that to how often gamepad users try to connect to a malicious website - probably hundreds or ever thousands of times a day.

Loosening certificate validation further expose the many less than competent users to risk, and the potential impact both on the customer base and on the product's reputation are significantly higher than the risks of making it cost a couple bucks a year to allow your gamepad to connect to a local server.

For something like a computer, there is a legitimate argument for allowing the user to bypass SSL/TLS restrictions (after some resistance) because laptops are used for development.

I can almost guarantee that the gamepad developers had an options for certificate validation bypass in it's developer options, but they're not gonna expose that needlessly when it offers no benefit, but exposes their customers to additional risk. Your gamepad is likely not a development device after all

Re: iOS 18 breaks IMAPS self-signed certs

#53

Post by lxgr »

stephenmac98 wrote: post #52
lxgr wrote: post #44

Earlier quoted context omitted.

Or is operating a local-only mailserver not connected to the larger internet? I guess that's a lazy or stupid thing too, these days... I'm a fan of having TLS on by default for everything on the Internet, but I'm seriously annoyed by the collateral damage to local self-hosted services the implementation of that has caused. It shouldn't be this hard to e.g. host web server on my local network that browsers grace with…

You have to consider the rarity of your use case vs the use case they're defending against. How often do you think someone tries to connect their gamepad to a local server? Not never, but the total amount of users doing it is probably high tens or low hundreds at most Compare that to how often gamepad users try to connect to a malicious website - probably hundreds or ever thousands of times a day. Loosening certifica…

Any malicious website can access my gamepad, since it can trivially get a Letsencrypt certificate – the only requirement for getting "secure origin" API access.

What exactly is this restriction preventing me from, then? (And what does a malicious website do with my gamepad data anyway?)

> Not never, but the total amount of users doing it is probably high tens or low hundreds at most

Yes, I'm fully aware that local hosting is rare in the grand scheme of things, but I think you're vastly underestimating the potential. It's currently not even possible to do much better even as a commercial NAS provider, and these are somewhat popular.

A big part of that also seems like a chicken and egg problem: Fewer and fewer users do it because it's getting harder and harder, thanks to browser standards and OS defaults being largely driven by stakeholders that have no interest in it becoming easier.

Yes, none of this is an evil conspiracy; it's just a question of incentives and priorities in the end. I just find it so sad how willingly even a "hacker" audience here embraces the move towards more and more centralization, on more than one dimension. (Peer-to-peer vs. client-to-server, "trusted CA only" vs. trust on first use, cloud vs. self-hosting etc.)

Re: iOS 18 breaks IMAPS self-signed certs

#54

Post by urda »

cpach wrote: post #22
urda wrote: post #12

Earlier quoted context omitted.

Yes, I have a private CA I install on all my Apple devices for my self-signed certs. After I have the root CA on the device, it looks like any other valid SSL to iOS / macOS.

Nit-pick: In that case the certs aren’t self-signed, they are regular leaf certs, chained to a “non-standard” CA.

This is true, the user I replied to was asking about root CA's so I tried to address that.

Re: iOS 18 breaks IMAPS self-signed certs

#55

Post by stephenmac98 »

lxgr wrote: post #51
User11110 wrote: post #50

Earlier quoted context omitted.

Internal CAs and self signed certificates are different. You can still generate a CA, sign your certificates, import your own CA into your phone and have that verify your certificates. You don't need Letsencrypt. But you'll learn in time.

Thanks for the condescension, but I know how to do all of this. I've done it before. And because of that, I can first hand attest that it's way too complicated . No non-sophisticated user is able to run their own local CA, and that's why their NAS, IoT setup etc. all run over HTTP only, which in turn has implications for available web APIs (thanks to "secure origin only" policies and no exemption for local IPs/zeroco…

If a user set up a NAS they should be capable of googling

"Openssl how to set up a CA" > First link fully explains it https://arminreiter.com/2022/01/create-your-own-certificate-...

"How to import CA into iPhone" > First link fully explains it https://www.ibm.com/docs/en/mpf/7.1.0?topic=certificates-ins...

"Android app customize trusted CAs" > First link fully explains it https://developer.android.com/privacy-and-security/security-...

The barrier to entry on PKI isn't that it's hard, it seems to be that people just can't be bothered, PKI is among the most google-able tech processes out there

Re: iOS 18 breaks IMAPS self-signed certs

#56

Post by lxgr »

stephenmac98 wrote: post #55
lxgr wrote: post #51

Earlier quoted context omitted.

Thanks for the condescension, but I know how to do all of this. I've done it before. And because of that, I can first hand attest that it's way too complicated . No non-sophisticated user is able to run their own local CA, and that's why their NAS, IoT setup etc. all run over HTTP only, which in turn has implications for available web APIs (thanks to "secure origin only" policies and no exemption for local IPs/zeroco…

If a user set up a NAS they should be capable of googling "Openssl how to set up a CA" > First link fully explains it https://arminreiter.com/2022/01/create-your-own-certificate-... "How to import CA into iPhone" > First link fully explains it https://www.ibm.com/docs/en/mpf/7.1.0?topic=certificates-ins... "Android app customize trusted CAs" > First link fully explains it https://developer.android.com/privacy-and-sec…

Setting up a NAS means buying one on Amazon and plugging it in.

You're completely out of touch with the majority of the userbase of these products if you think even one in 10 NAS users will set up their own CA using OpenSSL (in a secure way that doesn't expose themselves to being MITMed even on public sites such as that of their bank down the road).

Re: iOS 18 breaks IMAPS self-signed certs

#57

Post by diogocp »

lxgr wrote: post #44
stephenmac98 wrote: post #14

It's 2024, PKI best practices are well known and well documented, anybody still using a self-signed certs on their mail server (or anywhere) is either lazy or stupid. Plenty of existing applications will refuse to connect to a self-signed certificate on the belief that allowing the end-user to confirm a certificate offers basically 0 protection against malicious actors.

Or is operating a local-only mailserver not connected to the larger internet? I guess that's a lazy or stupid thing too, these days... I'm a fan of having TLS on by default for everything on the Internet, but I'm seriously annoyed by the collateral damage to local self-hosted services the implementation of that has caused. It shouldn't be this hard to e.g. host web server on my local network that browsers grace with…

> We absolutely need a localhost and local domain exemption for both TLS/X.509 certificate validation and web APIs.

localhost is already considered a secure origin.

Local networks are horribly insecure; easily the most likely place for a MITM attack.

Re: iOS 18 breaks IMAPS self-signed certs

#58

Post by benmmurphy »

punnerud wrote: post #27

I wish they could break Snapchat, Facebook etcs ‘s self-signed certs. I own the device, why can’t I see the traffic to and from all of these apps if I add my self-signed cert and approve to use a MITM-proxy. Most apps work, but not everyone. Often called certificate pinning.

If you jailbreak your phone then you are able to remove certificate pinning. If you just want to do this for research purposes then you can buy an old iPhone6s, iPhone8 or iPhoneX and use checkra1n which uses a bug early in the bootchain in order to jailbreak the phone. I think palera1n is based on checkra1n and might have better support for newer iOS versions: https://palera.in/

Re: iOS 18 breaks IMAPS self-signed certs

#59

Post by londons_explore »

lxgr wrote: post #41
londons_explore wrote: post #31

Earlier quoted context omitted.

Apple could say "If you wanna talk HTTPS, you have to use our HTTPSClient class, and that only supports using the system certificate store and does not support pinning". Or they could say "All apps that don't support custom certificates for https will be denied app store approval".

While you're at it, make sure to have them prohibit any encryption on top of HTTPS, or apps might just be hiding things in application-level encryption schemes! Banning certificate pinning... Do we really need mandated insecurity by prohibiting apps from doing better than trusting all Apple-trusted CAs around the world?

A better rule might be "You must use our HTTPSClient class, and it either uses the system+user trust stores, or optionally it uses an application supplied certificate authority+the user trust store".

Re: iOS 18 breaks IMAPS self-signed certs

#60

Post by mmd45 »

stephenmac98 wrote: post #45
mmd45 wrote: post #16

Earlier quoted context omitted.

explain how a pinned self signed cert is insecure. i don't see it. it would seem to be more secure than one signed by a public CA that's not pinned.

I didn't say a "pinned self signed cert is insecure" I said that self-signed certs are a lazy choice I also said "allowing the end-user to confirm a certificate offers basically 0 protection" If an average user get's prompted to trust a certificate they will do so blindly At most, someone might look at the subject, but it's 0 effort for a malicious actor to generate a self-signed cert with the same subject, which wil…

for the use case of a single user IMAP server this is all way, way, too complicated and buys you nothing in terms of security. it's completely analogous to why we dont use CAs to validate openssh host certificates.
Post reply on HN