31 ms·

Root certificate updates are a massive security issue. Blaming Let's Encrypt is blaming one of the canaries for the coal mine disaster. 33% of Android devices d

Root certificate updates are a massive security issue. Blaming Let's Encrypt is blaming one of the canaries for the coal mine disaster. 33% of Android devices don't and can't get up to date root certificates is an impressive security crisis that grows worse by the year (look at the other root expirations and the crazy workarounds that for instance Netflix has been doing to still work on older Android devices). Shouldn't the blame squarely be on Google, the Android OEMs, and the phone carriers for allowing this disaster to happen in the first place? I realize that is a tough message to get out to users and site owners are going to be in the cross-fire, but it seems better to try to work for solidarity in pointing fingers at the right direction and the right direction certainly isn't Let's Encrypt.

cpach 6y ago
That makes me curious, what workarounds did Netflix employ?
- Aissen 6y ago
  When you control the client, it's simple, you can do pretty much anything: embed your own HTTP stack, TLS stack, your QUIC stack, or simply your PKI, or subset of the webPKI.
- WorldMaker 6y ago
  It was the BBC I was actually thinking about, and it's a part of this article (which also mentions this Let's Encrypt root change): https://scotthelme.co.uk/impending-doom-root-ca-expiring-legacy-clients/ https://scotthelme.co.uk/impending-doom-root-ca-expiring-leg... Previous HN discussion on that article: https://news.ycombinator.com/item?id=23455463 https://news.ycombinator.com/item?id=23455463
est31 6y ago
Yes the issue is really severe of most deployed Android devices not getting security updates, either at all, or the devices are used well beyond the update period. But this is not up to Let's Encrypt to solve. They market themselves to build products for the mass market instead of small niches of the market, say, everyone who buys a new phone every year. But then they also have to treat their product like a mass market product, and if Android users still use older versions of the OS, then Let's Encrypt should adopt for that.
- thayne 6y ago
  This problem isn't unique to Let's Encrypt. Let's Encrypt is not the only entity with certificates signed by DST Root X3. And as these devices get older, more root certificates will expire. What happens when all of them expire? What is unique about Let's Encrypt, is they may have a harder time getting cross-signed by a CA that will still have a valid root cert on these devices for a significant amount of time, because, as has been pointed out in other comments, Let's Encrypt is disrupting the CA industry.
jacquesm 6y ago
They will be happy to accept that blame, as long as you fork over your $ for a new device. Planned obsolescence can have many components, this is just one of them.

cpach 6y ago

That makes me curious, what workarounds did Netflix employ?

Aissen 6y ago
When you control the client, it's simple, you can do pretty much anything: embed your own HTTP stack, TLS stack, your QUIC stack, or simply your PKI, or subset of the webPKI.
WorldMaker 6y ago
It was the BBC I was actually thinking about, and it's a part of this article (which also mentions this Let's Encrypt root change): https://scotthelme.co.uk/impending-doom-root-ca-expiring-legacy-clients/ https://scotthelme.co.uk/impending-doom-root-ca-expiring-leg... Previous HN discussion on that article: https://news.ycombinator.com/item?id=23455463 https://news.ycombinator.com/item?id=23455463

est31 6y ago

Yes the issue is really severe of most deployed Android devices not getting security updates, either at all, or the devices are used well beyond the update period. But this is not up to Let's Encrypt to solve. They market themselves to build products for the mass market instead of small niches of the market, say, everyone who buys a new phone every year. But then they also have to treat their product like a mass market product, and if Android users still use older versions of the OS, then Let's Encrypt should adopt for that.

thayne 6y ago
This problem isn't unique to Let's Encrypt. Let's Encrypt is not the only entity with certificates signed by DST Root X3. And as these devices get older, more root certificates will expire. What happens when all of them expire? What is unique about Let's Encrypt, is they may have a harder time getting cross-signed by a CA that will still have a valid root cert on these devices for a significant amount of time, because, as has been pointed out in other comments, Let's Encrypt is disrupting the CA industry.

jacquesm 6y ago

They will be happy to accept that blame, as long as you fork over your $ for a new device. Planned obsolescence can have many components, this is just one of them.