9 ms·

I'm concerned that the net effect of this will be to make the Internet less secure. In most cases, webmasters will be forced to make a Faustian choice: live wit

I'm concerned that the net effect of this will be to make the Internet less secure. In most cases, webmasters will be forced to make a Faustian choice: live with the scary warning in Chrome for modern users or give up support of browsers running on Windows XP (pre-SP3) and early versions of Android (pre-2.3), since they don't support certificates with a more secure hash than SHA1. We'll likely write a blog post soon on how much of the Internet still uses these old browsers. It's a startling amount. While it's unlikely to be the parts of the web where Google generates a large amount of ad revenue (e.g., China), so perhaps they don't care, I am concerned the net effect will be a web that is actually less secure. At CloudFlare, we have a plan to handle this gracefully for our customers (with both modern Chrome and old OSs) ahead of the change, but it's a non-trivial engineering challenge that many organizations won't make. I worry that, faced with the choice above, many organizations will simply opt not to support HTTPS at all. And, from my vantage point, that's a bigger risk to web security today than certificates signed with a SHA1 hash.

ivanr 12y ago
Not responding directly to your point (that this might make the Internet less secure), but there is also another approach -- deploying with two certificates. You can have a RSA/SHA1 certificate for older software and an ECDSA/SHA256 certificate for modern user agents. That should keep everyone happy. I dare say that, with some effort, it might even be possible to have a RSA/SHA1 and RSA/SHA256 certificate combination for the same host. Of course, doing that is a lot of work. But at least your company is in a position to do the work once and automate it afterwards for all your customers.
- eastdakota 12y ago
  Yes, that's what we're doing at CloudFlare. However, the patches to do it in major web server platforms are best characterized as "experimental" -- which is spooky for organizations to deploy into production environments. (We plan on open sourcing any work we do to improve them.) But, given how hard it is for most web admins to even manage one certificate, configuring a server to correctly manage two is... daunting. As you suggest, this change is undoubtedly good for our business, but I think it's bad for the web.
  - secalex 12y ago
    Although I'm an AGL fanboy (I have his rookie card) I have to agree with Matthew here. Pushing the transition this fast, just when the world is on the verge of accepting HTTPS as the default, is reckless and will overall reduce the safety of the Internet. FYI, we are deploying in the same manner as Cloudflare, with RSA/SHA1 and ECDSA/SHA256 side-by-side. We are committing our changes to the public ATS repository and hopefully those changes are useful to other projects. Unfortunately this is dependent on OpenSSL 1.0.2, so we might have to deploy beta code into production if the OpenSSL project can't beat Chrome's arbitrary deadline.
agl 12y ago
The world will be switching to SHA-256 - Microsoft already decided that last November [1]. This is just Chrome helping out. Obviously, XP is a problem. We're planning on prompting Chrome users on affected versions to update, both at startup and on the error page. SP3 does exist and one doesn't need to pass the Genuine Windows check to install it[2] so I think we have a good chance to getting users to update once sites stop working. Even if you're going to serve different chains based on signature_algorithms, that gets you at most a year of extra time. Maybe you should be putting effort into getting people to SP3 instead? :) [1] https://technet.microsoft.com/en-us/library/security/2880823.aspx https://technet.microsoft.com/en-us/library/security/2880823... [2] http://support.microsoft.com/kb/322389 http://support.microsoft.com/kb/322389
- eastdakota 12y ago
  While I'm a huge fan of what you're doing in terms of crypto at Google, it's hard for me to see this decision as anything other than reckless. I think we'll be able to show a number of empirical examples of how, over the coming months, it will make the web a less secure place as sites that we're just now starting to convince to adopt crypto will stop. I do at least hope that you will make efforts to alert more of the general public of what's coming and how they can prepare ahead of time. While at CloudFlare we follow the crypto lists closely and know there have been discussions for some time, dropping this news quietly for general public consumption on the Google blog on a Friday afternoon was... an odd choice. And, for the record, for the last two years we've made it one-click simple for any of the millions of sites on CloudFlare to alert their users to move off out-of-date browsers: https://www.cloudflare.com/apps/abetterbrowser https://www.cloudflare.com/apps/abetterbrowser
  - agl 12y ago
    Unfortunately we don't have the technical ability, nor do people have the mental capacity, to cope with multiple URL schemes for different "levels" of security. SHA-1 limits the security for everyone and all uses. And if sites are worried about compat, Google will be doing this transition along with everyone else. That's a good tailwind to ride. If Microsoft's 2016/2017 deadline is reckless, what SHA-1 deprecation date would be right by your measure? Some have suggested ~2020 (5 years issuance from 2015). Would you really be happy depending on SHA-1 in 2020? (Edit: on re-read, the 2020 suggestion sounds like a strawman - but that's actually what we were on the road towards and we may not have even managed that.)
cbsmith 12y ago
> It's a startling amount. It's a startling amount today. Just by virtue of making the announcement, Google knocks that number down quite a bit. Honestly, in a world where your choices are "doesn't work" and "secure", and there is no in between "works but isn't secure", security becomes a LOT simpler.
AlyssaRowan 12y ago
All XP users (including the zillions of pirated ones) can and should upgrade to SP3, free. That leaves aside the question of whether they should still be on the internet, sitting and waiting for the exploit which enables the next "Sapphire". That is going to be a fun day. I'll bring marshmallows. The situation with Android, vendors, old versions, device abandonment and lack of security patches is terribly disappointing across the ecosystem. It does not have the same excuse of age that Windows XP does. I'm not sure how to remedy that, and I'm not even completely sure why it happened in the first place except for the melting pot of: carriers wanting complete images to test and to remain completely stable (big mistake: most software really needs security patches deployable globally within hours!); SoC vendors with closed-source binary blob drivers, and this being tolerated in the ecosystem (big mistake: this means when it's dead to the vendor it's dead to everyone, because ABI changes); and versions with high minimum memory requirements (which is improving recently, but I feel if you can't go back and run it on the ADP1, and it doesn't run worse than it ever did, you're still not really done with that yet). Projects like CyanogenMod at least help there. I agree it is shocking how many are still out there, but given the choice between "HTTPS being secure" and "supporting insanely old/insecure software", choosing the latter seems like the kind of choice people will vividly remember when they come to regret it later.
- agwa 12y ago
  > choice between "HTTPS being secure" and "supporting insanely old/insecure software", I think there are really three outcomes: 1. HTTPS is widely used, it's secure, insanely old/insecure software is not supported. (Ideal outcome) 2. HTTPS is widely used, but using SHA1 certs for a little longer so that insanely old/insecure software is supported. 3. HTTPS is less widely used, but is secure with SHA2 certs, and insanely old/insecure software is still supported. My concern (and Matthew's too I think) is that the aggressive deprecation of SHA1 will put us on a trajectory to outcome 3. We're at a unique point in history right now: there is incredible momentum behind converting sites to HTTPS, even sites that traditionally would not have used HTTPS (such as all static sites). The SHA1 deprecation might throw a wrench into this and cause site operators to reconsider switching to HTTPS. If not for this momentum, I'd agree that aggressively deprecating SHA1 would be the clearly correct course of action, but at this moment in history I'm deeply ambivalent. Disrupting the HTTPS momentum would be very sad, especially since switching to HTTPS provides an immediate defense against mass passive eavesdropping.
hstrauss 12y ago
For Windows XP and Server 2003, there is a hotfix: http://support.microsoft.com/kb/968730 http://support.microsoft.com/kb/968730 This enables SHA-2 certificates. Deployment of the patch is another problem, since it's a HotFix (which may have enterprise-QA issues) and not intended for general use, AFAIK. Still, I've been using it since WS2008 originally came out.
- Gregordinary 12y ago
  The hotfix KB 968730 for Server 2003 includes updates from hotfix KB 938397. An important thing to note from KB 938397 is that "KB 938397 will bring Windows Server 2003 to the same level of functionality as Windows XP with Service Pack 3." [1] What that translates to is that it only gives Server 2003 SHA2 support as a client, not as a server. I.e. You can connect to sites that are using SHA2 certs, but you cannot bind a SHA2 cert to your own website in IIS 6/Server 2003. So once SHA1 is completely deprecated, those hosting sites or legacy apps on Windows Server 2003 will not be able to upgrade to SHA2 certs. [1] http://blogs.technet.com/b/pki/archive/2010/09/30/sha2-and-windows.aspx http://blogs.technet.com/b/pki/archive/2010/09/30/sha2-and-w...
- yuhong 12y ago
  Luckily, MS stripped the GDR branch from all XP/Server 2003 patches one year before XP went out of support, and https://support.microsoft.com/kb/2868626 https://support.microsoft.com/kb/2868626 was released after that was done.
nknighthb 12y ago
I'm extremely troubled that CloudFlare is taking this short-sighted stance. The faustian choice will soon be between having no security on any platform and supporting ancient platforms. This could come at any time. It could already be too late. Like it or not, you are a security company. You should act like it. This is not acting like it.
serge2k 12y ago
XP SP3 was released in 2008 and android 2.3 was released in 2010. At some point support should be dropped.

ivanr 12y ago

Not responding directly to your point (that this might make the Internet less secure), but there is also another approach -- deploying with two certificates. You can have a RSA/SHA1 certificate for older software and an ECDSA/SHA256 certificate for modern user agents. That should keep everyone happy. I dare say that, with some effort, it might even be possible to have a RSA/SHA1 and RSA/SHA256 certificate combination for the same host. Of course, doing that is a lot of work. But at least your company is in a position to do the work once and automate it afterwards for all your customers.

eastdakota 12y ago
Yes, that's what we're doing at CloudFlare. However, the patches to do it in major web server platforms are best characterized as "experimental" -- which is spooky for organizations to deploy into production environments. (We plan on open sourcing any work we do to improve them.) But, given how hard it is for most web admins to even manage one certificate, configuring a server to correctly manage two is... daunting. As you suggest, this change is undoubtedly good for our business, but I think it's bad for the web.
- secalex 12y ago
  Although I'm an AGL fanboy (I have his rookie card) I have to agree with Matthew here. Pushing the transition this fast, just when the world is on the verge of accepting HTTPS as the default, is reckless and will overall reduce the safety of the Internet. FYI, we are deploying in the same manner as Cloudflare, with RSA/SHA1 and ECDSA/SHA256 side-by-side. We are committing our changes to the public ATS repository and hopefully those changes are useful to other projects. Unfortunately this is dependent on OpenSSL 1.0.2, so we might have to deploy beta code into production if the OpenSSL project can't beat Chrome's arbitrary deadline.

agl 12y ago

The world will be switching to SHA-256 - Microsoft already decided that last November [1]. This is just Chrome helping out. Obviously, XP is a problem. We're planning on prompting Chrome users on affected versions to update, both at startup and on the error page. SP3 does exist and one doesn't need to pass the Genuine Windows check to install it[2] so I think we have a good chance to getting users to update once sites stop working. Even if you're going to serve different chains based on signature_algorithms, that gets you at most a year of extra time. Maybe you should be putting effort into getting people to SP3 instead? :) [1] https://technet.microsoft.com/en-us/library/security/2880823.aspx https://technet.microsoft.com/en-us/library/security/2880823... [2] http://support.microsoft.com/kb/322389 http://support.microsoft.com/kb/322389

eastdakota 12y ago
While I'm a huge fan of what you're doing in terms of crypto at Google, it's hard for me to see this decision as anything other than reckless. I think we'll be able to show a number of empirical examples of how, over the coming months, it will make the web a less secure place as sites that we're just now starting to convince to adopt crypto will stop. I do at least hope that you will make efforts to alert more of the general public of what's coming and how they can prepare ahead of time. While at CloudFlare we follow the crypto lists closely and know there have been discussions for some time, dropping this news quietly for general public consumption on the Google blog on a Friday afternoon was... an odd choice. And, for the record, for the last two years we've made it one-click simple for any of the millions of sites on CloudFlare to alert their users to move off out-of-date browsers: https://www.cloudflare.com/apps/abetterbrowser https://www.cloudflare.com/apps/abetterbrowser
- agl 12y ago
  Unfortunately we don't have the technical ability, nor do people have the mental capacity, to cope with multiple URL schemes for different "levels" of security. SHA-1 limits the security for everyone and all uses. And if sites are worried about compat, Google will be doing this transition along with everyone else. That's a good tailwind to ride. If Microsoft's 2016/2017 deadline is reckless, what SHA-1 deprecation date would be right by your measure? Some have suggested ~2020 (5 years issuance from 2015). Would you really be happy depending on SHA-1 in 2020? (Edit: on re-read, the 2020 suggestion sounds like a strawman - but that's actually what we were on the road towards and we may not have even managed that.)

cbsmith 12y ago

> It's a startling amount. It's a startling amount today. Just by virtue of making the announcement, Google knocks that number down quite a bit. Honestly, in a world where your choices are "doesn't work" and "secure", and there is no in between "works but isn't secure", security becomes a LOT simpler.

AlyssaRowan 12y ago

All XP users (including the zillions of pirated ones) can and should upgrade to SP3, free. That leaves aside the question of whether they should still be on the internet, sitting and waiting for the exploit which enables the next "Sapphire". That is going to be a fun day. I'll bring marshmallows. The situation with Android, vendors, old versions, device abandonment and lack of security patches is terribly disappointing across the ecosystem. It does not have the same excuse of age that Windows XP does. I'm not sure how to remedy that, and I'm not even completely sure why it happened in the first place except for the melting pot of: carriers wanting complete images to test and to remain completely stable (big mistake: most software really needs security patches deployable globally within hours!); SoC vendors with closed-source binary blob drivers, and this being tolerated in the ecosystem (big mistake: this means when it's dead to the vendor it's dead to everyone, because ABI changes); and versions with high minimum memory requirements (which is improving recently, but I feel if you can't go back and run it on the ADP1, and it doesn't run worse than it ever did, you're still not really done with that yet). Projects like CyanogenMod at least help there. I agree it is shocking how many are still out there, but given the choice between "HTTPS being secure" and "supporting insanely old/insecure software", choosing the latter seems like the kind of choice people will vividly remember when they come to regret it later.

agwa 12y ago
> choice between "HTTPS being secure" and "supporting insanely old/insecure software", I think there are really three outcomes: 1. HTTPS is widely used, it's secure, insanely old/insecure software is not supported. (Ideal outcome) 2. HTTPS is widely used, but using SHA1 certs for a little longer so that insanely old/insecure software is supported. 3. HTTPS is less widely used, but is secure with SHA2 certs, and insanely old/insecure software is still supported. My concern (and Matthew's too I think) is that the aggressive deprecation of SHA1 will put us on a trajectory to outcome 3. We're at a unique point in history right now: there is incredible momentum behind converting sites to HTTPS, even sites that traditionally would not have used HTTPS (such as all static sites). The SHA1 deprecation might throw a wrench into this and cause site operators to reconsider switching to HTTPS. If not for this momentum, I'd agree that aggressively deprecating SHA1 would be the clearly correct course of action, but at this moment in history I'm deeply ambivalent. Disrupting the HTTPS momentum would be very sad, especially since switching to HTTPS provides an immediate defense against mass passive eavesdropping.

hstrauss 12y ago

For Windows XP and Server 2003, there is a hotfix: http://support.microsoft.com/kb/968730 http://support.microsoft.com/kb/968730 This enables SHA-2 certificates. Deployment of the patch is another problem, since it's a HotFix (which may have enterprise-QA issues) and not intended for general use, AFAIK. Still, I've been using it since WS2008 originally came out.

Gregordinary 12y ago
The hotfix KB 968730 for Server 2003 includes updates from hotfix KB 938397. An important thing to note from KB 938397 is that "KB 938397 will bring Windows Server 2003 to the same level of functionality as Windows XP with Service Pack 3." [1] What that translates to is that it only gives Server 2003 SHA2 support as a client, not as a server. I.e. You can connect to sites that are using SHA2 certs, but you cannot bind a SHA2 cert to your own website in IIS 6/Server 2003. So once SHA1 is completely deprecated, those hosting sites or legacy apps on Windows Server 2003 will not be able to upgrade to SHA2 certs. [1] http://blogs.technet.com/b/pki/archive/2010/09/30/sha2-and-windows.aspx http://blogs.technet.com/b/pki/archive/2010/09/30/sha2-and-w...
yuhong 12y ago
Luckily, MS stripped the GDR branch from all XP/Server 2003 patches one year before XP went out of support, and https://support.microsoft.com/kb/2868626 https://support.microsoft.com/kb/2868626 was released after that was done.

nknighthb 12y ago

I'm extremely troubled that CloudFlare is taking this short-sighted stance. The faustian choice will soon be between having no security on any platform and supporting ancient platforms. This could come at any time. It could already be too late. Like it or not, you are a security company. You should act like it. This is not acting like it.

serge2k 12y ago

XP SP3 was released in 2008 and android 2.3 was released in 2010. At some point support should be dropped.