5 ms·

Can someone please explain why this encryption limitation is OS level and not application level? XP can't handle new encryption but why can't Firefox/Chrome on

Can someone please explain why this encryption limitation is OS level and not application level? XP can't handle new encryption but why can't Firefox/Chrome on XP handle it? Why can't they include their own updated encryption code within their browser?

hannob 11y ago
Firefox and Chrome can. But lots of people use the system's browser, just because they don't know how to install their own browser. Also you have to consider that there are devices out there that include a browser, but no way to install your own software. Gaming consoles, phones, TVs etc. with included browsers, many of them with outdated technologies and with no way to update or install your own software.
- dchest 11y ago
  Many of such devices are also unsafe to use if they haven't been upgraded.
pilif 11y ago
They can and they do. Mozilla uses NSS, Chrome their own OpenSSL fork (BoringSSL). This only really affects IE and other applications which don't have to be actual browsers. This mess also affects me greatly because I have around 2k Windows Mobile 6 based barcode scanners around which use SSL. Their HTTP client is just using the OS provided APIs. Now we're going to have to use a self-signed cert and update the application to accept that pinned cert
- caf 11y ago
  Couldn't you use a your-own-CA-signed cert and update the OS's trust list to include your CA?
  - pilif 11y ago
    Yes. That would also be an option. We'll see what works best (read: with the least amount of work. We're not selling these devices any more, so effort spent in supporting them is basically wasted)
    - ptaipale 11y ago
      I wouldn't call product support "wasted" effort. It's the responsible thing to do, and if you don't do it, you deserve to go down the drain.
      - pilif 11y ago
        No need to guilt-trip me. Of course we're going to make sure the scanners keep working (as I said in my previous comment). However, it's also clear that we'll have to take the route that requires the least amount of effort for the fix as any time spent on these old scanners is time we can't spend on the current android based scanners that provide a vastly superior user experience.
        ptaipale 11y ago
        I don't mean to guilt-trip you. I merely think that maintenance of provided solutions is what a responsible company should do. So in this case, personally, I think what you do is not wasted effort. It's not wasted effort because (I hope that) customers will remember whether the provided solution broke down and vendor just walked away, or whether your company took responsibility of architectural decisions.
        pilif 11y ago
        > It's not wasted effort because (I hope that) customers will remember whether the provided solution broke down and vendor just walked away, or whether your company took responsibility of architectural decisions. sure. But at some point you have to make a cut off. Customers can't expect a solution they bought once to work for all eternity. Otherwise we'd all still be supporting IE5 on Windows 98 these days. At some point, the time invested in keeping the old stuff running cuts too much into the time available to move the current stuff forward. If all you do is spending time to patch up the old solution, you open yourself to be overtaken by competitors that either don't care about their old infrastructure, or by competitors that just entered the market without any prior customers to care about. So really, keeping old stuff working (for some reasonable amount of time) is the ethical thing to do and certainly goes a long way to keep customers happy, at some point, you have to move forward or you will not be able to gain new customers, or worse, your old customers jump to a competitor that has the new, shiny thing and you end up maintaining a dwindling amount of legacy installations forever until you go out of business. This is why I think spending time on maintaining outdated, 10 year old solutions is wasting time compared to maintaining the new and greatly improved thing. Again: Despite these scanners being 10 years old now, we will do the effort required, but I still will try to do it the easiest way possible as every minute spent on this is a minute not spent on improving the non-outdated solution.
- userbinator 11y ago
  One solution is to use a proxy. I run a filtering proxy, and force all HTTP and HTTPS traffic through it. It can be upgraded easily since it uses the standard OpenSSL DLLs. Courtesy of that, this comment has been posted to HN with TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, from a client that only supports TLS 1.0 and nothing beyond RC4-MD5. (It's actually configured to ask for ECDHE-RSA-AES256-GCM-SHA384 first, which is probably overkill, so I don't see many servers that choose it.)
  - pilif 11y ago
    That's another very good idea I'm going to look into, though I'm a bit weary of dealing with writing and/or finding and compiling a proxy server for a version of Windows CE that's now 4 years out of support.
lifeisstillgood 11y ago
The article mentions this - "most" people are running the latest Firefix/Chrime browser or smartphone and will have been upgraded. The danger is in "developing countries" (sic) where we can see older operating systems, cracked versions of Windows with no upgrade path, dumbphones that do not do encryption and of course anyone in the office of personnel management.
edent 11y ago
There's also the bootstrapping problem. Let's say you want to get the latest browser for your phone/PC - how do you download it with your default browser? Even if Firefox had a plain http site for legacy downloads - how could you trust the executable?
- MichaelApproved 11y ago
  Technically, you could check the hash, no? Of course, you'd need a reliable source to give you the hash, so you could make sure you weren't given a fake hash of the fake download. So, you'd lookup the hash on a secure computer and then test the download after you insecurely downloaded it. Of course, this is more than a general consumer would know or care to bother with.
  - tokenizerrr 11y ago
    And then you also need a reliable source for your hashing tool, since I don't think Windows XP (which is the most problematic) ships one.
- jenscow 11y ago
  Authenticode?
mtgx 11y ago
Blame Microsoft for tying their browsers to the OS (which they are still doing even in Windows 10).
- vbezhenar 11y ago
  Why is it bad? If they update browser, they can update OS component. And if they dropped support for OS, new browsers are unlikely to work in this OS anyway. It's not the case for 3-rd party browsers, of course, but IE is an integral part of Windows. So it makes sense to avoid crypto duplication.
  - kuschku 11y ago
    Because it might be better if the browser would be updated even years after the support for XP has been dropped? At least update IE, or show people the Browserchoice Window with a message saying "IE is no longer supported, select another browser"
  - michaelt 11y ago
    And if they dropped support for OS, new browsers are unlikely to work in this OS anyway. Firefox and Chrome manage to support XP just fine.

hannob 11y ago

Firefox and Chrome can. But lots of people use the system's browser, just because they don't know how to install their own browser. Also you have to consider that there are devices out there that include a browser, but no way to install your own software. Gaming consoles, phones, TVs etc. with included browsers, many of them with outdated technologies and with no way to update or install your own software.

dchest 11y ago
Many of such devices are also unsafe to use if they haven't been upgraded.

pilif 11y ago

They can and they do. Mozilla uses NSS, Chrome their own OpenSSL fork (BoringSSL). This only really affects IE and other applications which don't have to be actual browsers. This mess also affects me greatly because I have around 2k Windows Mobile 6 based barcode scanners around which use SSL. Their HTTP client is just using the OS provided APIs. Now we're going to have to use a self-signed cert and update the application to accept that pinned cert

caf 11y ago
Couldn't you use a your-own-CA-signed cert and update the OS's trust list to include your CA?
- pilif 11y ago
  Yes. That would also be an option. We'll see what works best (read: with the least amount of work. We're not selling these devices any more, so effort spent in supporting them is basically wasted)
  - ptaipale 11y ago
    I wouldn't call product support "wasted" effort. It's the responsible thing to do, and if you don't do it, you deserve to go down the drain.
    - pilif 11y ago
      No need to guilt-trip me. Of course we're going to make sure the scanners keep working (as I said in my previous comment). However, it's also clear that we'll have to take the route that requires the least amount of effort for the fix as any time spent on these old scanners is time we can't spend on the current android based scanners that provide a vastly superior user experience.
      - ptaipale 11y ago
        I don't mean to guilt-trip you. I merely think that maintenance of provided solutions is what a responsible company should do. So in this case, personally, I think what you do is not wasted effort. It's not wasted effort because (I hope that) customers will remember whether the provided solution broke down and vendor just walked away, or whether your company took responsibility of architectural decisions.
        pilif 11y ago
        > It's not wasted effort because (I hope that) customers will remember whether the provided solution broke down and vendor just walked away, or whether your company took responsibility of architectural decisions. sure. But at some point you have to make a cut off. Customers can't expect a solution they bought once to work for all eternity. Otherwise we'd all still be supporting IE5 on Windows 98 these days. At some point, the time invested in keeping the old stuff running cuts too much into the time available to move the current stuff forward. If all you do is spending time to patch up the old solution, you open yourself to be overtaken by competitors that either don't care about their old infrastructure, or by competitors that just entered the market without any prior customers to care about. So really, keeping old stuff working (for some reasonable amount of time) is the ethical thing to do and certainly goes a long way to keep customers happy, at some point, you have to move forward or you will not be able to gain new customers, or worse, your old customers jump to a competitor that has the new, shiny thing and you end up maintaining a dwindling amount of legacy installations forever until you go out of business. This is why I think spending time on maintaining outdated, 10 year old solutions is wasting time compared to maintaining the new and greatly improved thing. Again: Despite these scanners being 10 years old now, we will do the effort required, but I still will try to do it the easiest way possible as every minute spent on this is a minute not spent on improving the non-outdated solution.
userbinator 11y ago
One solution is to use a proxy. I run a filtering proxy, and force all HTTP and HTTPS traffic through it. It can be upgraded easily since it uses the standard OpenSSL DLLs. Courtesy of that, this comment has been posted to HN with TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256, from a client that only supports TLS 1.0 and nothing beyond RC4-MD5. (It's actually configured to ask for ECDHE-RSA-AES256-GCM-SHA384 first, which is probably overkill, so I don't see many servers that choose it.)
- pilif 11y ago
  That's another very good idea I'm going to look into, though I'm a bit weary of dealing with writing and/or finding and compiling a proxy server for a version of Windows CE that's now 4 years out of support.

lifeisstillgood 11y ago

The article mentions this - "most" people are running the latest Firefix/Chrime browser or smartphone and will have been upgraded. The danger is in "developing countries" (sic) where we can see older operating systems, cracked versions of Windows with no upgrade path, dumbphones that do not do encryption and of course anyone in the office of personnel management.

edent 11y ago

There's also the bootstrapping problem. Let's say you want to get the latest browser for your phone/PC - how do you download it with your default browser? Even if Firefox had a plain http site for legacy downloads - how could you trust the executable?

MichaelApproved 11y ago
Technically, you could check the hash, no? Of course, you'd need a reliable source to give you the hash, so you could make sure you weren't given a fake hash of the fake download. So, you'd lookup the hash on a secure computer and then test the download after you insecurely downloaded it. Of course, this is more than a general consumer would know or care to bother with.
- tokenizerrr 11y ago
  And then you also need a reliable source for your hashing tool, since I don't think Windows XP (which is the most problematic) ships one.
jenscow 11y ago
Authenticode?

mtgx 11y ago

Blame Microsoft for tying their browsers to the OS (which they are still doing even in Windows 10).

vbezhenar 11y ago
Why is it bad? If they update browser, they can update OS component. And if they dropped support for OS, new browsers are unlikely to work in this OS anyway. It's not the case for 3-rd party browsers, of course, but IE is an integral part of Windows. So it makes sense to avoid crypto duplication.
- kuschku 11y ago
  Because it might be better if the browser would be updated even years after the support for XP has been dropped? At least update IE, or show people the Browserchoice Window with a message saying "IE is no longer supported, select another browser"
- michaelt 11y ago
  And if they dropped support for OS, new browsers are unlikely to work in this OS anyway. Firefox and Chrome manage to support XP just fine.