4 ms·

Remember the good old time when it was not an almighty cartel of browsers that controlled your internet? This is so an arbitrary decision and so much a pain in

Remember the good old time when it was not an almighty cartel of browsers that controlled your internet? This is so an arbitrary decision and so much a pain in the ass. Again, a limited number of people used their corporate interests to decide for the whole world with almost no discussion. The worst is that the "security" argument for this change is quite weak. Yes, we can think that shorter certificates are a little bit better to trust for the user, but that should be the choice of the website that you visit. Now, you as an user are so stupid, that browsers will decide for you what website is deemed safe for you to visit, the same as with appstores. Compared to the good old time, like traditional pc software installation, where it was you, the user that was free to decide the websites that you wanted to trust: google.com vs myshaddyfraudyweb.com

CydeWeys 6y ago
I'm surprised to see this as the highest comment on this post. This is a clear security win, and thus good for users. And no, I don't trust websites to have my best interests in mind, not remotely. Hell, if browsers hadn't started warning about insecure connections then I suspect that even to this day most websites would still be insecure. We used to leave it up to the choice of each website, and that was a clear failure, and now they're being forced to provide better security, which is a clear win.
- GordonS 6y ago
  I agree with you about publicly available websites, but I'm not convinced this policy makes sense for IoT devices, especially for ones that aren't connected to the internet.
hannob 6y ago
Yeah those good old times when Comodo was hacked and issued certificates for gmail.com and nobody really cared. Or when some shady CAs sold intermediate certificates in devices so you could man in the middle all your network connections (and everyone else's, too). So bad those times are over and we have this browser cartell enforcing some basic security standards for TLS. Screw them!
- koolba 6y ago
  Shortening the validity duration does not stop any of those issues. It just shortens the duration of a potential attack to one year.
  - fastball 6y ago
    Eliminate, no. But the goal of security is generally not to make breaches impossible, but to mitigate them / make them harder to achieve. It's an uphill battle but I'm glad browser vendors are fighting it.
  - hannob 6y ago
    The validity time is part of a process where browser vendors have tightened rules for CAs over time. We got plenty of gradual improvements over time. Validity time does not stop incidents, but it makes the impact smaller and allows ecosystem improvements to propagate faster. Take for example Certificate Transparency, which is one of the most important ecosystem improvements. It was required for new certificates in 2018. But we still can't rely on Certificate Transparency logging for all certificates, as the certificate lifetimes were so long. In the future such improvements will take maximum 1 year till all certificates have them.
superkuh 6y ago
Corporations think they have to protect people from themselves now because people are now required, even encouraged, to blindly run all remote code they're sent. It's because browsers have become the OS. And now it's standard to metaphorically open every email attachment you receive.
tialaramex 6y ago
CA/B isn't a cartel, indeed it jumps through a bunch of hoops to ensure it isn't a cartel. Cartels are illegal in many countries (the one you're most likely thinking of right now, OPEC, doesn't need to care that cartels are illegal because its members are sovereign entities, and thus they decide what the law is) Moreover, this didn't come from CA/B anyway, it was rejected there. CA/B agreed the previous 825 day limit, and the 39 month limit before that, but this new rule did not get support at CA/B so Apple imposed it unilaterally (and with some really poor communication but whatever). Google and Mozilla have just decided that since they wanted this limit, and Apple has effectively imposed it anyway, they might as well go along for the ride.
- Talanes 6y ago
  I'm pretty sure Google, Mozilla, and Apple are who they meant in the first place, not CA/B.
gruez 6y ago
>Compared to the good old time, like traditional pc software installation, where it was you, the user that was free to decide the websites that you wanted to trust: google.com vs myshaddyfraudyweb.com People can barely tell whether it's really microsoft calling them saying their computer is infected. What makes you think they'll be able to tell the difference between google.com and google-secure-login.com, or whether they should download the "codec pack" that their shady streaming site is offering?
Apofis 6y ago
You mean the good old days of IE 5.5?
yjftsjthsd-h 6y ago
> Yes, we can think that shorter certificates are a little bit better to trust for the user, but that should be the choice of the website that you visit. That sounds like a disagreement; it benefits the user, so let the website opt out? Because websites are known to have users' well-being in mind?
dageshi 6y ago
No, I don't. Browsers have always controlled the internet since the web became the dominant way the internet is used. And I'm really quite happy for them to do this because lord only knows helping my various relatives with their computers has proven to me that someone needs too.
Someone 6y ago
“Yes, we can think that shorter certificates are a little bit better to trust for the user, but that should be the choice of the website that you visit.” I would think the choice on how long to trust a certificate should be on the user, possibly using the hint that the creator of the certificate gave. You wouldn’t trust a certificate from evil-empire.com, no matter its expiration date, would you? The discussion should be about whether the browser should make that decision on behalf of the user. I’m not sure I’m in favor of that. On the other hand, browsers already do a lot in that domain, for example by their choice of trusted root certificates (and changes to that list)
- greatgib 6y ago
  Yes, maybe it was not clear but that was what I wanted to say: It should be the job of the website to decide the expiration date for it's certificate. So they decide if they want to look shady, careless and use 10 years certs or look like trustable and serious and use 6 months. And indeed users would be able to use that to determine the trust they give to a website. So in the end, websites determine their 'trust value' without the browsers 'police', that will let the possibility for special cases. For example, if I do a device that is to be used out of internet for 3 years, logically the user will not see an issue with a 5 years certificate.

CydeWeys 6y ago

I'm surprised to see this as the highest comment on this post. This is a clear security win, and thus good for users. And no, I don't trust websites to have my best interests in mind, not remotely. Hell, if browsers hadn't started warning about insecure connections then I suspect that even to this day most websites would still be insecure. We used to leave it up to the choice of each website, and that was a clear failure, and now they're being forced to provide better security, which is a clear win.

GordonS 6y ago
I agree with you about publicly available websites, but I'm not convinced this policy makes sense for IoT devices, especially for ones that aren't connected to the internet.

hannob 6y ago

Yeah those good old times when Comodo was hacked and issued certificates for gmail.com and nobody really cared. Or when some shady CAs sold intermediate certificates in devices so you could man in the middle all your network connections (and everyone else's, too). So bad those times are over and we have this browser cartell enforcing some basic security standards for TLS. Screw them!

koolba 6y ago
Shortening the validity duration does not stop any of those issues. It just shortens the duration of a potential attack to one year.
- fastball 6y ago
  Eliminate, no. But the goal of security is generally not to make breaches impossible, but to mitigate them / make them harder to achieve. It's an uphill battle but I'm glad browser vendors are fighting it.
- hannob 6y ago
  The validity time is part of a process where browser vendors have tightened rules for CAs over time. We got plenty of gradual improvements over time. Validity time does not stop incidents, but it makes the impact smaller and allows ecosystem improvements to propagate faster. Take for example Certificate Transparency, which is one of the most important ecosystem improvements. It was required for new certificates in 2018. But we still can't rely on Certificate Transparency logging for all certificates, as the certificate lifetimes were so long. In the future such improvements will take maximum 1 year till all certificates have them.

superkuh 6y ago

Corporations think they have to protect people from themselves now because people are now required, even encouraged, to blindly run all remote code they're sent. It's because browsers have become the OS. And now it's standard to metaphorically open every email attachment you receive.

tialaramex 6y ago

CA/B isn't a cartel, indeed it jumps through a bunch of hoops to ensure it isn't a cartel. Cartels are illegal in many countries (the one you're most likely thinking of right now, OPEC, doesn't need to care that cartels are illegal because its members are sovereign entities, and thus they decide what the law is) Moreover, this didn't come from CA/B anyway, it was rejected there. CA/B agreed the previous 825 day limit, and the 39 month limit before that, but this new rule did not get support at CA/B so Apple imposed it unilaterally (and with some really poor communication but whatever). Google and Mozilla have just decided that since they wanted this limit, and Apple has effectively imposed it anyway, they might as well go along for the ride.

Talanes 6y ago
I'm pretty sure Google, Mozilla, and Apple are who they meant in the first place, not CA/B.

gruez 6y ago

>Compared to the good old time, like traditional pc software installation, where it was you, the user that was free to decide the websites that you wanted to trust: google.com vs myshaddyfraudyweb.com People can barely tell whether it's really microsoft calling them saying their computer is infected. What makes you think they'll be able to tell the difference between google.com and google-secure-login.com, or whether they should download the "codec pack" that their shady streaming site is offering?

Apofis 6y ago

You mean the good old days of IE 5.5?

yjftsjthsd-h 6y ago

> Yes, we can think that shorter certificates are a little bit better to trust for the user, but that should be the choice of the website that you visit. That sounds like a disagreement; it benefits the user, so let the website opt out? Because websites are known to have users' well-being in mind?

dageshi 6y ago

No, I don't. Browsers have always controlled the internet since the web became the dominant way the internet is used. And I'm really quite happy for them to do this because lord only knows helping my various relatives with their computers has proven to me that someone needs too.

Someone 6y ago

“Yes, we can think that shorter certificates are a little bit better to trust for the user, but that should be the choice of the website that you visit.” I would think the choice on how long to trust a certificate should be on the user, possibly using the hint that the creator of the certificate gave. You wouldn’t trust a certificate from evil-empire.com, no matter its expiration date, would you? The discussion should be about whether the browser should make that decision on behalf of the user. I’m not sure I’m in favor of that. On the other hand, browsers already do a lot in that domain, for example by their choice of trusted root certificates (and changes to that list)

greatgib 6y ago
Yes, maybe it was not clear but that was what I wanted to say: It should be the job of the website to decide the expiration date for it's certificate. So they decide if they want to look shady, careless and use 10 years certs or look like trustable and serious and use 6 months. And indeed users would be able to use that to determine the trust they give to a website. So in the end, websites determine their 'trust value' without the browsers 'police', that will let the possibility for special cases. For example, if I do a device that is to be used out of internet for 3 years, logically the user will not see an issue with a 5 years certificate.