4 ms·
Do they know something we don't about SHA1? It's not usual for Microsoft to be a first mover in cases like these, as far as I can remember? Also, is there a s
by 0x0 13y ago
Do they know something we don't about SHA1?
It's not usual for Microsoft to be a first mover in cases like these, as far as I can remember?
Also, is there a source on *.microsoft.com for this announcement?
- dmethvin 13y agohttp://technet.microsoft.com/en-us/security/advisory/2880823 http://technet.microsoft.com/en-us/security/advisory/2880823 http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx?Redirected=true http://blogs.technet.com/b/srd/archive/2013/11/12/security-a...
- tptacek 13y agoProbably not. And, when it comes to crypto compatibility, there really is no such thing as "normal". It's all still early days.
- 0x0 13y agoJust noticed all four certs in the chain on https://www.microsoft.com https://www.microsoft.com use SHA1. The root cert, "Baltimore CyberTrust Root", expires in 2025. Will root CAs also have to be replaced by 2016? The relative urgency around this cutoff comes off as panick-y to me. They never seemed to bother updating roots or add SNI support for older, still supported OSes like WinXP.
- JohnTHaller 13y agoWindows XP is officially dead in 144 days, so they're likely unconcerned on that front.