Hacker News Reader

Comment by sippingabonedry | Hacker News Reader

I pointed this out yesterday and people thought I was nuts:

https://news.ycombinator.com/item?id=50189521

I suspect Apple published no update and is relying on the CA's CRL and/or OCSP to do its job. But it's rate-limited, the connections time out, and iOS is hard-coded to soft-fail.

Like you my trust store is months old.

That said, I found separate installs of Firefox and Microsoft Edge that accepted *all* the bad certificates without a care.

The only browser that consistently rejected all of them was — you guessed it — Internet Explorer. A browser so old it couldn't even run the test properly but it did what it needed to and blocked all the servers.

View on HN

To be honest, this whole experience has left me with a very sour taste in my mouth. It feels to me that the whole CA industry needs reform.

I am not smart enough to say how, but the sheer amount of work this created across the industry is monstrous. It probably has cost $billions to mitigate, and those mitigations have been slow and ineffective (see: my iPhone still being vulnerable).

In my experience, seemingly random pieces of software, libraries, and programming languages packaging their own CA stores has made this much harder to mitigate than simply running 'apt-get update ca-certificates'. We've practically just had to update every single thing to mitigate this.

Most of the stuff just seems/ feels to be (security) theatre. I actually disabled most of my OSCP, etc., for privacy reasons. No need to permanently send requests out to the web, when it won't help anyway when really required. I read HN to stay up-to-date and manually manage the certificates.

(Even with all the related options disabled, e.g., ocspd on OSX still regularly connects to random certificate related services to "check" on things. Something related to random root certificates I don't have in the system trust store or such, Not entirely sure what this is about and how to get rid of the requests in any other way than blocking things with Little Snitch)

Should go back to the good old days when Verisign was the only provider and they cost $500 each

The whole ordeal makes me wonder why the ergonomics/interface around CA trust management is not better.

It should be very easy and normal to ask for approval which is limited to the particular app, limited in time, and limited in scope.

Still keep defaults, but make it much smaller and put them under even higher scrutiny, certainly not 100 root certificates.

I don't understand why e.g. a CA for research institutions should be able to issue certificate for mybank.com or ecommerce.com and my browser would just trust that.

Firefox 158.0.1+ is the update that blocks them, are you running that?

I am and the test site says that Firefox is correctly rejecting them.

Reply on news.ycombinator.com