4 ms·
Let me get this straight. Sites across the internet are (hopefully) revoking their CAs and issuing new ones to address Heartbleed but Mr. Langley is suggesting
by Splendor 12y ago
Let me get this straight. Sites across the internet are (hopefully) revoking their CAs and issuing new ones to address Heartbleed but Mr. Langley is suggesting that we shouldn't check for revoked CAs because it might not do anything and it's slow?
Sorry, but after the last few weeks I'll happily accept a little slowness for the security revocation checking provides in the cases where it does work, even if it's not 100% of the cases.
- ars 12y agoI guess you didn't read the article? He's saying there are no cases where it works. Making it completely pointless.
- millerc 12y ago> That's why I claim that online revocation checking is useless - because it doesn't stop attacks. Doesn't mean there are "no" cases where it works. It just means any attacker dedicated enough can work around the CRLs. I don't see any reason why one should throw the baby with the water. In this case, I just see Chrome guilty of FUD and hiding behind an intractable problem to justify their incorrect position. See http://en.wikipedia.org/wiki/Two_Generals'_Problem http://en.wikipedia.org/wiki/Two_Generals'_Problem if you want to convince yourself the problem is intractable.
- Splendor 12y agoI did read the article. > "In order to end on a positive note, I'll mention a case where online revocation checking does work..."
- ars 12y agoThat's even more proof you didn't read it. How does enabling it in chrome make any difference to code signing?
- lallysingh 12y agoFunny how you didn't quote the actual case mentioned, just the text ahead of it. Ctrl-F'ing a little quick, eh?
- takeda 12y agoWell, his argument is also that the attacker can easily circumvent it, which is true, but it is still makes it slightly harder to do, because the attacker needs to remember it.
- mpyne 12y agoWell, this is what "security theater" is. If you said that exact thing in the context of a TSA screening program there would be no one here going "yes, that makes perfect sense", and it's even easier for network attackers; they have to fix their attack scripts once and they work for good until the next countermeasure.