4 ms·

Mmmm, great that and mandatory key rotation every 90 days, plus needing to get a cert from an approved CA, means just that more busy work to have an independent

by ottah 1y ago

Mmmm, great that and mandatory key rotation every 90 days, plus needing to get a cert from an approved CA, means just that more busy work to have an independent web presence. I don't like people externalizing their security policy preferences. Yes this might be more secure for a class of use-cases, but I as a user should be allowed to decide my threat model. It's not like these initiatives really solve the risks posed by bad actors. We have so much compliance theater around email, and we still have exactly the same threats and issues as existed twenty years ago.

antisol 1y ago
Impressive. I don't need to post my opinion on this anymore - you did it so much better than I ever could.
techbrovanguard 1y ago
You understand that key rotation can and should be automated, right?
- ottah 1y ago
  It adds complexity, more points of failure, and ensures that more legacy services will go offline needlessly. While almost certainly not actually improving the actual security issues the average user experience. Lack of a valid tls certificate is usually not the reason people are victims of crime online.
danpalmer 1y ago
HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer. > I as a user should be allowed to decide my threat model Asking you if you want to proceed is allowing you to decide your threat model. > We have so much compliance theater around email, and we still have exactly the same threats and issues as existed twenty years ago. ...and yet we have largely eliminated entire classes of issue on the web with the shift to HTTPS, to the point where asking users to opt-in to HTTP traffic is actually a practical option, raising the default security posture with minimal downside.
- yardstick 1y ago
  > HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer. A lot of this discussion is about how the browsers define their security requirements on top of HTTPS/TLS/etc. Such as what CAs they trust by default, and what’s the maximum lifetime of a certificate before they won’t trust it. I believe it is now 2 years? Going even lower soon.
  - saurik 1y ago
    They don't require key rotation, though, merely certificate busy work; if they wanted key rotation they could try to add some mechanism for it, but I've been using the same key for over a decade now.
- ottah 1y ago
  Well HTTPS the protocol might not, but the implementation is essentially going that way https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days https://www.digicert.com/blog/tls-certificate-lifetimes-will...
hylaride 1y ago
This is all automatable and is well documented for almost every setup. If you're on a cloud provider/CDN it's even easier as they'll handle all this for you at pretty much no cost. You can also still use your own threat model. You can use self-signed certs, import your own CA, etc. The issue is that browsers need to service the mass market, including the figurative grandma who won't otherwise understand fake bank certificates. As for email, yes...that is a complete shitshow and I'm still surprised it works as well as it does.
- ottah 1y ago
  I guarantee you that your grandmother will still get phished with a valid domain certificate.
zoeysmithe 1y ago
As someone who has run email servers, I can guarantee you none of this is theater. If you remove all the anti-spam backing, email becomes a useless service. At least the kind of 'accept mail from anyone' smtp thing we all decided to standardize on.

by ottah 1y ago

antisol 1y ago

Impressive. I don't need to post my opinion on this anymore - you did it so much better than I ever could.

techbrovanguard 1y ago

You understand that key rotation can and should be automated, right?

ottah 1y ago
It adds complexity, more points of failure, and ensures that more legacy services will go offline needlessly. While almost certainly not actually improving the actual security issues the average user experience. Lack of a valid tls certificate is usually not the reason people are victims of crime online.

danpalmer 1y ago

HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer. > I as a user should be allowed to decide my threat model Asking you if you want to proceed is allowing you to decide your threat model. > We have so much compliance theater around email, and we still have exactly the same threats and issues as existed twenty years ago. ...and yet we have largely eliminated entire classes of issue on the web with the shift to HTTPS, to the point where asking users to opt-in to HTTP traffic is actually a practical option, raising the default security posture with minimal downside.

yardstick 1y ago
> HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer. A lot of this discussion is about how the browsers define their security requirements on top of HTTPS/TLS/etc. Such as what CAs they trust by default, and what’s the maximum lifetime of a certificate before they won’t trust it. I believe it is now 2 years? Going even lower soon.
- saurik 1y ago
  They don't require key rotation, though, merely certificate busy work; if they wanted key rotation they could try to add some mechanism for it, but I've been using the same key for over a decade now.
ottah 1y ago
Well HTTPS the protocol might not, but the implementation is essentially going that way https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days https://www.digicert.com/blog/tls-certificate-lifetimes-will...

hylaride 1y ago

This is all automatable and is well documented for almost every setup. If you're on a cloud provider/CDN it's even easier as they'll handle all this for you at pretty much no cost. You can also still use your own threat model. You can use self-signed certs, import your own CA, etc. The issue is that browsers need to service the mass market, including the figurative grandma who won't otherwise understand fake bank certificates. As for email, yes...that is a complete shitshow and I'm still surprised it works as well as it does.

ottah 1y ago
I guarantee you that your grandmother will still get phished with a valid domain certificate.

zoeysmithe 1y ago

As someone who has run email servers, I can guarantee you none of this is theater. If you remove all the anti-spam backing, email becomes a useless service. At least the kind of 'accept mail from anyone' smtp thing we all decided to standardize on.