6 ms·

"The new cross-sign will expire in early 2024, and hopefully versions of Android from 2016 and earlier will be dead by then." Hard disagree. In this day and ag

by pyb 6y ago

"The new cross-sign will expire in early 2024, and hopefully versions of Android from 2016 and earlier will be dead by then." Hard disagree. In this day and age, a device or OS that is merely 8 years old should be able to function! Is the issue limited to Lets Encrypt? If so its usage should be discouraged.

Semaphor 6y ago
Just FYI, the issue is with certificates in general, nothing to do with LE specifically. Dumbed down, the problem is that someone the old device never heard of, is not trustworthy. Of course, an OS should still work after 8 years. But the problem is, that the OS has been abandoned (by the device manufacturer and possibly the community), so it is falling apart. Anything that accesses the internet needs regular maintenance to not become a security hazard.
- forty 6y ago
  I think it's a bit LE specific here though, since according to the article, real trust anchors do not expire on android, so it's only because LE is relatively new and was not a bundled CA root at the time, and had to be signed by a CA that was bundled (and this intermediate signature is what expires if I understand correctly)
  - Semaphor 6y ago
    It’s not, as any new CA would have the same problem.
maxerickson 6y ago
It's the interaction of certificate expiration with no OS updates. The lack of OS updates happen to correlate with hardware age for Android phones. That's also the reasonable place to apply pressure, to the people marketing devices with minimal future support, which means they quickly become insecure.
move-on-by 6y ago
I just got some combo smoke and carbon monoxide detectors that say replace every 7 years, so perhaps 8 years isn’t that bad?
- quesera 6y ago
  Received wisdom: Don't buy combination smoke & CO detectors. Smoke rises, so detectors are best placed on or near the ceiling. CO sinks, so detectors are best placed a few feet above the ground. Considering the importance of early notification of either condition, these requirements appear irreconcilable.
  - gene91 6y ago
    That's a myth according to this article [1] from a well known US brand of alarms. [1] https://support.firstalert.com/s/article/Where-to-install-CO-alarms https://support.firstalert.com/s/article/Where-to-install-CO...
    - quesera 6y ago
      Thank you for the correction!
- rini17 6y ago
  What, phones are dangerous to rely on after 7 years?
kibwen 6y ago
> In this day and age, a device or OS that is merely 8 years old should be able to function! There's no need to worry about this. If the scheme in the OP works, then the same trick can be used indefinitely until such time as the Android versions in question become completely marginal, be it 4, 40, or 400 years from now.

by pyb 6y ago

Semaphor 6y ago

Just FYI, the issue is with certificates in general, nothing to do with LE specifically. Dumbed down, the problem is that someone the old device never heard of, is not trustworthy. Of course, an OS should still work after 8 years. But the problem is, that the OS has been abandoned (by the device manufacturer and possibly the community), so it is falling apart. Anything that accesses the internet needs regular maintenance to not become a security hazard.

forty 6y ago
I think it's a bit LE specific here though, since according to the article, real trust anchors do not expire on android, so it's only because LE is relatively new and was not a bundled CA root at the time, and had to be signed by a CA that was bundled (and this intermediate signature is what expires if I understand correctly)
- Semaphor 6y ago
  It’s not, as any new CA would have the same problem.

maxerickson 6y ago

It's the interaction of certificate expiration with no OS updates. The lack of OS updates happen to correlate with hardware age for Android phones. That's also the reasonable place to apply pressure, to the people marketing devices with minimal future support, which means they quickly become insecure.

move-on-by 6y ago

I just got some combo smoke and carbon monoxide detectors that say replace every 7 years, so perhaps 8 years isn’t that bad?

quesera 6y ago
Received wisdom: Don't buy combination smoke & CO detectors. Smoke rises, so detectors are best placed on or near the ceiling. CO sinks, so detectors are best placed a few feet above the ground. Considering the importance of early notification of either condition, these requirements appear irreconcilable.
- gene91 6y ago
  That's a myth according to this article [1] from a well known US brand of alarms. [1] https://support.firstalert.com/s/article/Where-to-install-CO-alarms https://support.firstalert.com/s/article/Where-to-install-CO...
  - quesera 6y ago
    Thank you for the correction!
rini17 6y ago
What, phones are dangerous to rely on after 7 years?

kibwen 6y ago

> In this day and age, a device or OS that is merely 8 years old should be able to function! There's no need to worry about this. If the scheme in the OP works, then the same trick can be used indefinitely until such time as the Android versions in question become completely marginal, be it 4, 40, or 400 years from now.