6 ms·
> There is no information on how often the validation happens. I wrote a blog post about this. My analysis indicates that Developer ID OCSP responses were prev
by _qulr 6y ago
> There is no information on how often the validation happens.
I wrote a blog post about this. My analysis indicates that Developer ID OCSP responses were previously cached for 5 minutes, but Apple changed it to half a day after Thursday's outage, probably to reduce traffic:
https://lapcatsoftware.com/articles/ocsp.html https://lapcatsoftware.com/articles/ocsp.html
- saagarjha 6y ago5 minutes is an absurdly short cache time…
- _qulr 6y agoPure speculation from me, but my guess is that the intention is check an app on every launch, and the 5 minutes is there just to lower the chances of DoS from an app getting repeatedly launched for some reason.
- Spivak 6y agoIf you catch malware in the wild you don’t want to wait half a day for the cache to expire. Negative responses are typically cached for short periods of time. Can you imagine if people cached NXDOMAIN for half a day and someone creating a record had to wait 12 hours for it to go live because someone queried it?
- _qulr 6y ago> If you catch malware in the wild you don’t want to wait half a day for the cache to expire. But if you have a cached OCSP response for the cert of a malware author, then you've already launched their app, so it's probably too late.
- zepto 6y agoPlenty of kinds of malware are harmful each time they are launched, not just once.
- ethbr0 6y agoThe risk of launching malware a second+ time seems substantially less than the privacy leak caused by more frequent checks.
- zepto 6y agohttps://www.zdnet.com/article/apple-update-kills-off-zoom-web-server/ https://www.zdnet.com/article/apple-update-kills-off-zoom-we... This was a seriously exploitable issue that was a problem every time it was run. I agree that this certificate mechanism is absurdly problematic. That doesn’t justify dismissing the security risks it was intended to prevent.
- _qulr 6y agoZoom isn't malware, Apple did not revoke Zoom's Developer ID certificate, and indeed Zoom still exists on the Mac. Zoom had a serious uninstaller bug, but that's all it was, and it's not relevant to the current discussion.
- zepto 6y agoIncorrect - zoom exposed a serious vulnerability, and Apple shut it down, using another mechanism but nonetheless the same effect. It’s relevant because you argue that there is no value to having the ability to do this. It is also a problem which occurred every time the app was launched. Something you have dismissed as a non problem. https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-server-automatic-removal-silent-update-webcam-vulnerability https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-s...
- _qulr 6y ago> using another mechanism > It’s relevant because you argue that there is no value to having the ability to do this. No, I did not. We haven't talked about that other mechanism, so I've said nothing about it here either positively or negatively. > Something you have dismissed as a non problem. I said "Zoom had a serious uninstaller bug". So no, I did not dismiss it as a non problem. It just has nothing to do with Developer ID certificate OCSP. Please stop putting words in my mouth or completely warping the words that I do say.
- tsimionescu 6y agoIf you care about user privacy, you don't upload stuff from the user side, you download the list of trusted&untrusted certificates to the user's machine and take the decision there. This is how antiviruses have always worked, without affecting user privacy (of course, most antiviruses also did other things that DID affect user privacy, but malware detection at least worked perfectly fine without it).
- sildur 6y agoLet's not forget the inherent elitism of thinking everyone has a gigabit internet at their disposal. I happened to live in a developing county for years and this "waiting up to half a minute until the program opens" has been my daily experience for a long long time.
- smnrchrds 6y agoIf it's slow in developing countries, it is gonna be slow in smaller towns as well as rural areas in US and Canada, and depending on where the closest Apple server is, perhaps all of Australia and New Zealand.
- theginger 6y agoAny idea how they changed the cache time remotely? If the OS is honouring the cache control headers of a plain text response this has its own security implications.
- angry_octet 6y agoThe response is signed by Apple, and presumably (!) your Mac is validating that signature correctly. I haven't checked if they are using stapling, but that would be the sensible way to do it, in which case it is a server side parameter (though possibility with client side limits too, but you'd need to disassemble the binary).
- _qulr 6y agoThe OCSP response has a nextUpdate field: https://www.ietf.org/rfc/rfc2560.txt https://www.ietf.org/rfc/rfc2560.txt
- bogomipz 6y agoThis was a good read as was the HP OSCP incident you linked to in the post. With regards to HP cert being revoked I'm amazed that this didn't get more attention. You would think there would be checks in place to calculate something like "well there's been 100 million OSCP checks for this printer driver in the last 24 hours so we might not want to revoke its cert."