sleevi

7 ms·

1.
by sleevi 1y ago
All the time. Many CA distrust events involved some degree of “amateurs” reporting issues. While I hesitate to call commenters like agwa an amateur, it certainly was not professionally sponsored work by root programs or CAs. This is a key t
2.
by sleevi 3y ago
Because it wasn’t actually a server misconfiguration, nor was it, as others have speculated, about Postel’s Law. The way X.509 was designed - to the very first version - was the notion that you have your set of CAs you trust, I have my set,
3.
by sleevi 3y ago
Because this is not the “start of drafting” but roughly “final text that is largely a rubber stamp approval.” This is the output of having been through the the trilogue process - where the Parliament would/has shut things down before -
4.
by sleevi 3y ago
> and the recent legislation coming from there seems very inspired by the great firewall. https://www.europarl.europa.eu/RegData/etudes/STUD/2020/6487...
5.
by sleevi 3y ago
The EU is currently proposing to mandate the inclusion of roots that have been government approved, and to limit browsers from removing/distrusting them without notice/approval. https://www.eff.org/deeplinks/2
6.
by sleevi 5y ago
It’s actually a huge issue - look at how eliminating a key difficulty in obtaining certificates massively increased HTTPS adoption (via LetsEncrypt and others) Similarly, automation affects how easy or hard it is to replace a CA, for exampl
7.
by sleevi 5y ago
Yes, the current regulation is targeted at government sites authenticating citizens, but the goal with these revisions is to require VLOPs to support this, along with allowing them the ability to require this for all websites. The original
8.
by sleevi 5y ago
The QWACs can be issued by anyone who meets the minimum requirements, which are substantially less than those required for TLS server CAs in browsers. So while it’s true that banks can issue these, in practice there are many small companies
9.
by sleevi 5y ago
The proposed regulation requires that QWACs MUST be accepted and recognized as such, such as using the European List of Trusted Lists as part of the root store. That is, if a QWAC is issued by a CA that is not part of the browser root store
10.
by sleevi 5y ago
One element that results in less security is that it becomes more difficult to replace. For example, QWACs cannot legally be automated (e.g. via ACME), because of certain restrictions applied to needing to validate the natural or legal pers
11.
by sleevi 5y ago
Yes. It requires the EU Trustmark, a logo designed through a secondary-school competition, to be displayed with certain colors and sizing, as directed through Implementing Acts (which have the force of law, but decided at the Commission lev
12.
by sleevi 5y ago
The draft revisions actually propose such authentication to be mandatory to implement for service providers if their users would like to use it. That is, it specifically targets websites (particularly Very Large Online Platforms) that they
13.
by sleevi 5y ago
https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A20...
14.
Revisiting BetterTLS: Certificate Path Building(netflixtechblog.com)
6 points by sleevi 5y ago|0 comments
15.
by sleevi 5y ago
Do you have links to documentation on the Apple Pay requirement? That sounds like Apple Pay is encouraging certificate pinning, and I suspect the Apple Root Program may have opinions to the contrary, given how it puts Apple users at risk to
16.
by sleevi 5y ago
As others have noted, many of these issues are fundamental to XML DSig, which is insecure by design. [1] However, the “what does the future hold” of OIDC is not much brighter. OIDC is based on JSON Web Tokens (JWT), which manages to avoid s
17.
by sleevi 5y ago
Example app: NuGet for .NET on Linux and MacOS, from Microsoft: https://github.com/NuGet/Announcements/issues/56 It used SSL/TLS and S/MIME roots to verify code signing and timestamping responses. W
18.
by sleevi 5y ago
Using (defined) properties of the TLS ClientHello to determine how the server will respond. For example, changing the certificate used based on the ALPN identity, the SNI server host, and the advertised client ciphersuites.
19.
by sleevi 6y ago
No more related to Android than any other Chrome supported OS. The post linked in the article, https://g.co/chrome/root-policy makes it clear: the goal is to provide a consistent, cross-platform experience to the Web.
20.
by sleevi 6y ago
https://cloud.google.com/docs/chrome-enterprise/policies?pol... There’s more that could be said, but I can see this is an emotionally loaded subject for you, so perhaps it’s best dealt with as it rolls out. Every
21.
by sleevi 6y ago
Some of this isn’t correct (e.g. Firefox totally reads HKCU - https://searchfox.org/mozilla-central/source/security/manage... - which is necessary to work with AV ), but I’ll the the first to tell you that a
22.
by sleevi 6y ago
Happy to be up front here: as we call out in https://g.co/chrome/root-policy , the goal is to support the things the user installed and authorized. The priority of constituencies for the Web is a little different than
23.
by sleevi 6y ago
No, that’s not it: none of the code has landed yet It’s a big enough change that we’re explaining before landing. We’re taking an approach similar to Firefox’s implementation ( https://searchfox.org/mozilla-central/s
24.
by sleevi 6y ago
https://g.co/chrome/root-policy , which is linked to in that mail, states in the third paragraph: > If you’re an enterprise managing trusted CAs for your organization, including locally installed enterprise CAs, th
25.
by sleevi 6y ago
The overlay is only used by Chrome on ChromeOS (the doc goes into some of the details there), so effectively, the “Chrome OS” root store is being sunset. On a practical, technical level, I’ll probably just leave the overlay in place because
26.
by sleevi 6y ago
Firefox has historically checked OCSP by default everywhere but for Firefox mobile, where it was only checked for EV certs. With the introduction of CRLite, the default is disabled, but those using Firefox with internal-use private CAs on
27.
by sleevi 6y ago
https://cloud.google.com/docs/chrome-enterprise/policies/?po...
28.
by sleevi 6y ago
1. Legacy 2. Trust Domains (half completed, but littered throughout the code as nss3 prefix). This was being lead by Sun and stopped when Oracle acquired them. 3. libpkix: This was done by porting Java code to C using preprocessor macros to
29.
by sleevi 6y ago
https://medium.com/@sleevi_/path-building-vs-path-verifying-... also has some utilities to visualize this using JS to explore these relationships, and understand the code tradeoffs.
30.
by sleevi 6y ago
I think you’re right for questioning the end-state, but you may be missing the current status quo. The current status quo of multi-purpose roots is that supervision of a root, by a browser, auditor, and the CA themselves, constantly has to

More ›