3 ms·

I don't quite understand why anyone would send data in clear text anymore, let alone Apple.

douglasdrumz 6y ago
It's explained in the article, there's a loop if you want to verify a certificate and you need the certificate to verify the certificate
- pedro2 6y ago
  Check server certificate OCSP first, send subsequent queries via SSL.
  - lstamour 6y ago
    Precisely. This would require more work, but it would only leak the OCSP server’s revocation request, and would make OCSP both more secure (caching OCSP server validity rather than the original certificates) and more private (due to SSL).
- sneak 6y ago
  You can do unauthenticated TLS, which is no worse than plaintext HTTP, and foils passive listeners by providing privacy. You could also trust your existing trusted certs (prior to OCSP update) when doing the OCSP update, which, again, is no worse than plaintext HTTP. Apple knows this. They have cryptography experts. Taken in context with their backdooring of their e2e messenger and collaboration with military intelligence on FISA 702, I tend not to give them the benefit of the doubt any longer. Apple knows how to take pcaps. There are only so many times the OS design gets to leak either keys or plaintext remotely before you need to stop assuming ignorance over malice. I don’t know how many times that is, but it’s less than ten, probably less than 5, and because it’s a count of legitimate “assume ignorance”, then “goto fail”[2] also counts in the tally. Between this OCSP plaintext telemetry leak, and iMessage default key escrow, scrapping their plan for e2e backups at the behest of the FBI that fixes the key escrow backdoor[3], and “goto fail” not authenticating TLS, we’re at 4. I’m not even counting the recent story about Apple’s history of willing collaboration with intelligence agencies to make a custom classified firmware for the iPod to aid in espionage.[1] As Goldfinger’s famous saying goes: “Once is happenstance. Twice is coincidence. The third time it’s enemy action.” [1]: https://news.ycombinator.com/item?id=24212520 https://news.ycombinator.com/item?id=24212520 [2]: https://www.zdnet.com/article/apples-goto-fail-tells-us-nothing-good-about-cupertinos-software-delivery-process/ https://www.zdnet.com/article/apples-goto-fail-tells-us-noth... [3]: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
  - zepto 6y ago
    “ I’m not even counting the recent story about Apple’s history of willing collaboration with intelligence agencies to make a custom classified firmware for the iPod to aid in espionage.” What would this ‘count’ as?
captn3m0 6y ago
Has anyone tried a revocation list-over bloom filters? Similar to how Google's Safe Browsing filter works? If there's a hit, a subsequent request can be sent to Apple to verify the same - reducing the impact.
neurostimulant 6y ago
Maybe there is a bizzare reason why they don't use https on their ocsp endpoint. Perhaps they want to avoid situation where the ocsp server's certificate itself is revoked, or anticipated that the ocsp server would still be in use 10 years later where the currently used crypto could have been marked as insecure and removed and thus prevent older clients from working. Or it could be laziness, but come on...

It's explained in the article, there's a loop if you want to verify a certificate and you need the certificate to verify the certificate

pedro2 6y ago
Check server certificate OCSP first, send subsequent queries via SSL.
- lstamour 6y ago
  Precisely. This would require more work, but it would only leak the OCSP server’s revocation request, and would make OCSP both more secure (caching OCSP server validity rather than the original certificates) and more private (due to SSL).
sneak 6y ago
You can do unauthenticated TLS, which is no worse than plaintext HTTP, and foils passive listeners by providing privacy. You could also trust your existing trusted certs (prior to OCSP update) when doing the OCSP update, which, again, is no worse than plaintext HTTP. Apple knows this. They have cryptography experts. Taken in context with their backdooring of their e2e messenger and collaboration with military intelligence on FISA 702, I tend not to give them the benefit of the doubt any longer. Apple knows how to take pcaps. There are only so many times the OS design gets to leak either keys or plaintext remotely before you need to stop assuming ignorance over malice. I don’t know how many times that is, but it’s less than ten, probably less than 5, and because it’s a count of legitimate “assume ignorance”, then “goto fail”[2] also counts in the tally. Between this OCSP plaintext telemetry leak, and iMessage default key escrow, scrapping their plan for e2e backups at the behest of the FBI that fixes the key escrow backdoor[3], and “goto fail” not authenticating TLS, we’re at 4. I’m not even counting the recent story about Apple’s history of willing collaboration with intelligence agencies to make a custom classified firmware for the iPod to aid in espionage.[1] As Goldfinger’s famous saying goes: “Once is happenstance. Twice is coincidence. The third time it’s enemy action.” [1]: https://news.ycombinator.com/item?id=24212520 https://news.ycombinator.com/item?id=24212520 [2]: https://www.zdnet.com/article/apples-goto-fail-tells-us-nothing-good-about-cupertinos-software-delivery-process/ https://www.zdnet.com/article/apples-goto-fail-tells-us-noth... [3]: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
- zepto 6y ago
  “ I’m not even counting the recent story about Apple’s history of willing collaboration with intelligence agencies to make a custom classified firmware for the iPod to aid in espionage.” What would this ‘count’ as?

captn3m0 6y ago

Has anyone tried a revocation list-over bloom filters? Similar to how Google's Safe Browsing filter works? If there's a hit, a subsequent request can be sent to Apple to verify the same - reducing the impact.

neurostimulant 6y ago

Maybe there is a bizzare reason why they don't use https on their ocsp endpoint. Perhaps they want to avoid situation where the ocsp server's certificate itself is revoked, or anticipated that the ocsp server would still be in use 10 years later where the currently used crypto could have been marked as insecure and removed and thus prevent older clients from working. Or it could be laziness, but come on...