4 ms·

Why should it be centralized at the os level? Https certificate trust is basically the last thing I think about when I choose an os. (And for certain OSes I us

by marky1991 2y ago

Why should it be centralized at the os level? Https certificate trust is basically the last thing I think about when I choose an os. (And for certain OSes I use, I actively don't trust its authors/owners)

tptacek 2y ago
It is genuinely weird to think Microsoft should get a veto over your browser if that browser stops trusting a CA, right?
- hello_computer 2y ago
  that’s not what he meant, and you know it. he means use the OS store (the one the user has control over), instead of having each app do its own thing (where the user may or may not have control, and even if he does have it, now has to tweak settings in a dozen places instead of one). they try to pull the same mess with DNS (i.e. Mozilla’s DoH implementation)
  - tptacek 2y ago
    I don't understand, because the user has control over the browser store too. (As an erstwhile pentester, btw, fuck the OS certificate store; makes testing sites a colossal pain).
    - hello_computer 2y ago
      > I don't understand, because the user has control over the browser store too. i already mentioned that ("may or may not"). former or latter, per-app CA management is an abomination from security and administrative perspectives. from the security perspective, abandonware (i.e. months old software at the rate things change in this business) will become effectively "bricked" by out-of-date CAs and out-of-date revocation lists, forcing the users to either migrate (more $$$), roll with broken TLS, or even bypass it entirely (more likely); from the administrative perspective, IT admins and devops guys will have to wrangle each application individually. it raises the hurdle from "keep your OS up-to-date" to "keep all of your applications up-to-date". > As an erstwhile pentester exactly. you're trying to get in. per-app config makes your life easier. as an erstwhile server-herder, i prefer the os store, which makes it easier for me to ensure everything is up-to-date, manage which 3rd-party CAs i trust & which i don't, and cut 3rd-parties out-of-the-loop entirely for in-house-only applications (protected by my own CA).
      - tptacek 2y ago
        It's baffling to me that anyone would expect browsers to make root store decisions optimized for server-herders. You're not their userbase!
        hello_computer 2y ago
        neither are pentesters
        tptacek 2y ago
        Right, I don't think the pentester use case here is at all dispositive; in fact, it's approximately as meaningful as the server-herders.
    - mwcampbell 2y ago
      > (As an erstwhile pentester, btw, fuck the OS certificate store; makes testing sites a colossal pain) Can you please explain? I'm just curious, not arguing.
      - tptacek 2y ago
        It's a good question! When you're testing websites, you've generally got a browser set up with a fake root cert so you can bypass TLS. In that situation, you want one of your browsers to have a different configuration than your daily driver.
- chicom_malware 2y ago
  The only thing that is genuinely weird is having four different certificate stores on a system, each with different trusted roots, because the cabals of man-children that control the WebPKI can't set aside their petty disagreements and reach consensus on anything. Which makes sense, because that would require them all to relinquish some power to their little corner of the Internet, which they are all unwilling to do. This fuckery started with Google, dissatisfied with not having total control over the entire Internet, deciding they're going to rewrite the book for certificate trust in Chrome only (turns out after having captured the majority browser market share and having a de-facto monopoly, you can do whatever you want). I don't blame Mozilla having their own roots because that is probably just incompetence on their part. It's more likely they traded figuring out interfacing with OS crypto APIs for upkeep on 30 year old Netscape cruft. Anyone who has had to maintain large scale deployments of Firefox understands this lament and knows what a pain in the ass it is.

tptacek 2y ago

It is genuinely weird to think Microsoft should get a veto over your browser if that browser stops trusting a CA, right?

hello_computer 2y ago
that’s not what he meant, and you know it. he means use the OS store (the one the user has control over), instead of having each app do its own thing (where the user may or may not have control, and even if he does have it, now has to tweak settings in a dozen places instead of one). they try to pull the same mess with DNS (i.e. Mozilla’s DoH implementation)
- tptacek 2y ago
  I don't understand, because the user has control over the browser store too. (As an erstwhile pentester, btw, fuck the OS certificate store; makes testing sites a colossal pain).
  - hello_computer 2y ago
    > I don't understand, because the user has control over the browser store too. i already mentioned that ("may or may not"). former or latter, per-app CA management is an abomination from security and administrative perspectives. from the security perspective, abandonware (i.e. months old software at the rate things change in this business) will become effectively "bricked" by out-of-date CAs and out-of-date revocation lists, forcing the users to either migrate (more $$$), roll with broken TLS, or even bypass it entirely (more likely); from the administrative perspective, IT admins and devops guys will have to wrangle each application individually. it raises the hurdle from "keep your OS up-to-date" to "keep all of your applications up-to-date". > As an erstwhile pentester exactly. you're trying to get in. per-app config makes your life easier. as an erstwhile server-herder, i prefer the os store, which makes it easier for me to ensure everything is up-to-date, manage which 3rd-party CAs i trust & which i don't, and cut 3rd-parties out-of-the-loop entirely for in-house-only applications (protected by my own CA).
    - tptacek 2y ago
      It's baffling to me that anyone would expect browsers to make root store decisions optimized for server-herders. You're not their userbase!
      - hello_computer 2y ago
        neither are pentesters
        tptacek 2y ago
        Right, I don't think the pentester use case here is at all dispositive; in fact, it's approximately as meaningful as the server-herders.
  - mwcampbell 2y ago
    > (As an erstwhile pentester, btw, fuck the OS certificate store; makes testing sites a colossal pain) Can you please explain? I'm just curious, not arguing.
    - tptacek 2y ago
      It's a good question! When you're testing websites, you've generally got a browser set up with a fake root cert so you can bypass TLS. In that situation, you want one of your browsers to have a different configuration than your daily driver.
chicom_malware 2y ago
The only thing that is genuinely weird is having four different certificate stores on a system, each with different trusted roots, because the cabals of man-children that control the WebPKI can't set aside their petty disagreements and reach consensus on anything. Which makes sense, because that would require them all to relinquish some power to their little corner of the Internet, which they are all unwilling to do. This fuckery started with Google, dissatisfied with not having total control over the entire Internet, deciding they're going to rewrite the book for certificate trust in Chrome only (turns out after having captured the majority browser market share and having a de-facto monopoly, you can do whatever you want). I don't blame Mozilla having their own roots because that is probably just incompetence on their part. It's more likely they traded figuring out interfacing with OS crypto APIs for upkeep on 30 year old Netscape cruft. Anyone who has had to maintain large scale deployments of Firefox understands this lament and knows what a pain in the ass it is.