4 ms·

OCSP doesn't seem like the right protocol for this. Apple should probably just ship you a list of hashes of revoked certificates once a day, and should do the

OCSP doesn't seem like the right protocol for this. Apple should probably just ship you a list of hashes of revoked certificates once a day, and should do the check locally. (Obviously, the global certificate database is too big to send to every user, but Apple should be able to determine the subset of certificates they trust, and the even smaller subset of those that are revoked or compromised.) To me, it sounds like they decided to take the quick-and-easy path of reusing an existing protocol for the use case of stopping malware, but it doesn't really fit. The latency, privacy, and availability guarantees of OCSP just don't match with the requirements for "run a local application".

m463 6y ago
There might also be usage data they collect conveniently.
Nightshaxx 6y ago
I agree, how is sending a list of revoked certs not the best idea?
ben509 6y ago
Going back to a CRL (certificate revocation list) for code-signing certs makes more sense. And, really, there shouldn't be a huge number of developer certs being revoked. If that's happening, they need to put more work up front into certifying them in the first place.
wiml 6y ago
This does seem like a situation where a CRL would be a better fit than OCSP. On the other hand, CRLs have been pretty thoroughly deprecated for browser usage, so Apple probably just reached for the first tool that was already available to them.
- viraptor 6y ago
  Is actually the other way. Active ocsp checks have been removed some time ago: https://www.computerworld.com/article/2501274/google-chrome-will-no-longer-check-for-revoked-ssl-certificates-online.html https://www.computerworld.com/article/2501274/google-chrome-... Stapling and crl-shipped-with-browser still works.
kelnos 6y ago
Wild (probably wrong) theory: Apple doesn't want us to know how many developer certs they've had to revoke, and who owned them.

m463 6y ago

There might also be usage data they collect conveniently.

Nightshaxx 6y ago

I agree, how is sending a list of revoked certs not the best idea?

ben509 6y ago

Going back to a CRL (certificate revocation list) for code-signing certs makes more sense. And, really, there shouldn't be a huge number of developer certs being revoked. If that's happening, they need to put more work up front into certifying them in the first place.

wiml 6y ago

This does seem like a situation where a CRL would be a better fit than OCSP. On the other hand, CRLs have been pretty thoroughly deprecated for browser usage, so Apple probably just reached for the first tool that was already available to them.

viraptor 6y ago
Is actually the other way. Active ocsp checks have been removed some time ago: https://www.computerworld.com/article/2501274/google-chrome-will-no-longer-check-for-revoked-ssl-certificates-online.html https://www.computerworld.com/article/2501274/google-chrome-... Stapling and crl-shipped-with-browser still works.

kelnos 6y ago

Wild (probably wrong) theory: Apple doesn't want us to know how many developer certs they've had to revoke, and who owned them.