So MCUs or any embedded that doesn't get updates will likely only be good for up to the validity of the included CA root before bricking up?
These days thats up to 15 years. Talk about programmed obsolescence.
These days thats up to 15 years. Talk about programmed obsolescence.
If you don't, you can never tell what a device is sending/receiving, and devices have a hardcoded end-of-life date where they become useless. Would love to see groups starting to push in this direction.
Also would be quite complex for regular users to even grasp and then to choose their trust provider. Cynical me thinks this would just end up giving more power to the device manufacturers and centralize on handful of better known 'trust providers'. No non-techie person I know has heard of Verisign but everyone knows Meta.
If you can feed it a fake NTP server that's set in the past, then it could potentially stay vulnerable forever, especially if you're the one doing a MITM on it... otherwise attempts to contact third-party servers you're not masquerading as will likely fail due to expired certs (some time in 2028 IIRC for the eMudhra ones).
But the fake NTP approach makes sense to fool them for either intended or vulnerable purposes.