5 ms·
Moving away from obsolete crap isn't the solution, it's the definition of the problem. One could argue that the CA/Browser forum has achieved some success with
by Nimi 11y ago
Moving away from obsolete crap isn't the solution, it's the definition of the problem.
One could argue that the CA/Browser forum has achieved some success with moving away from SHA-1. As a spectator, I don't understand why this process is not repeated for similar obsolete primitives or standards.
- Gibbon1 11y agoI read an blog post by a guy with a long experience with this. What happens is large players demand that there be a 'reasonable' deadline for compliance. And then half the companies involved sit on their hands for two and a half years and then demand an extension. And then another and next thing you know you're still using RSA fifteen years after people knew they needed to stop using it. Only solution I can think of is to create some sort of license where once the sunset deadline is established, the license to use it expires hard on the deadline.
- Nimi 11y agoThat's very interesting, do you happen to have a link for the blog post?
- Natanael_L 11y agoProbably this https://medium.com/@sleevi_/a-history-of-hard-choices-c1e1cc9bb089#.626z71jce https://medium.com/@sleevi_/a-history-of-hard-choices-c1e1cc...
- Gibbon1 11y agoThanks that would be the one. I get this feeling that encryption protocols and standards often end up and all sorts of dank corners of the web infrastructure and finding and updating all of these is really messy task. And I suspect service providers and their customers haven't been really good at keeping track of everything.
- Nimi 11y agoFascinating. I still feel I'm missing something basic here: If Microsoft, Google and Mozilla announce they're not going to accept any particular crypto primitive two years from now, and this time there won't be any exceptions, CAs and websites just have to abide, don't they?
- Natanael_L 11y agoThen a bunch of big companies announce they'll use another browser to be able to keep using it
- Nimi 11y agoAnother browser beside Chrome, Firefox and IE? OK, so Symantec announces that they will only use Opera. Even then, they have to deal with their customers, website operators who need a certificate trusted by the big 3 browsers, leaving. In fact, now that Let's Encrypt certificates are free, it seems like this is the Symantec CA's worst nightmare.
- Natanael_L 11y agoNot CA:s, but clients like banks
- nl 11y agoThe browsers say what they accept, the server says what it provides and something in the intersecting set will be used. If (as a random example that didn't annoy me at all for 2 years) a website also needs to support SmartTV devices which only accept obsolete certificates then your server has to either break them or not.