agwa

14 ms·

151.
by agwa 2y ago
Everything I described can be done programmatically. I've written the code to do it. But anyways, as mcpherrinm reminded me, certificates will still have the CRL Distribution Point extension so you can forget what I said about the CCA
152.
by agwa 2y ago
Indeed! I forgot that the BRs mandate the CRLDP extension if the certificate lacks OCSP AIA. So all (non-short-lived) certificates will continue to have a standard revocation checking mechanism encoded in them.
153.
by agwa 2y ago
CT doesn't tell you if a certificate is revoked, so the CA still has to operate a revocation system. That revocation system can forget about certificates.
154.
by agwa 2y ago
To check if a certificate is revoked, you can look up its issuer in the CCADB ( https://ccadb.my.salesforce-sites.com/ccadb/AllCertificateRe... ) to find the URL(s) of its CRL(s), and then check the CRL(s) for the serial
155.
by agwa 2y ago
Yeah, that would be a good idea. Though sometimes the CA needs to know more than just the validation method to determine if a certificate should be revoked, and it's not practical to stuff it all in an extension (e.g. this recent GoDad
156.
by agwa 2y ago
Yeah, I looked into nginx's stapling implementation almost a decade ago. I fixed some simpler bugs (I submitted a patch which was mostly rewritten and then merged) but fixing the problem you mention would have required major re-archite
157.
by agwa 2y ago
Google Trust Services lets you go down to 1 day using ACME. No payment required.
158.
by agwa 2y ago
Do you disagree that OCSP would be significantly less costly and complex if the responder URL were not included in certificates, freeing the responders from having to serve hundreds of millions of clients?
159.
by agwa 2y ago
When a CA has an incident, such as learning that one of their domain validation methods is flawed, they need to be able revoke all certificates impacted by the incident. Without a reliable database of certificates, there's no guarantee
160.
by agwa 2y ago
Mozilla and Chrome were requiring it via the incorporation of the Baseline Requirements into their policies. The removal of the requirement from the BRs won't appear in the release notes of their policies.
161.
by agwa 2y ago
Currently only 20,830,034 revoked certificates per my daily CRL download, versus ~1 billion active certificates. But the number of revoked certs could balloon if there's another Heartbleed-like event, or a mass misissuance.
162.
by agwa 2y ago
Let's Encrypt will surely not be the only CA to discontinue OCSP after Microsoft removes their requirement.
163.
by agwa 2y ago
Many web servers have terrible to nonexistent OCSP stapling implementations.
164.
by agwa 2y ago
After I created OCSP Watch[1], I regularly detected CAs returning an OCSP response of unknown or unauthorized for certificates found in CT logs, indicating that they had basically forgotten that they had issued a certificate. I find that r
165.
by agwa 2y ago
Increased demand for privacy, which has already led competing browsers to kill 3P cookies. Note that Google wasn't willing to kill 3P cookies without providing Privacy Sandbox an an alternative, less privacy-invasive, way for publisher
166.
by agwa 2y ago
To be clear, the outcome quoted above (Privacy Sandbox, no 3P cookies, ~20% reduction in ad revenue) is what Google wanted but regulators (spurred on by the ad industry) wouldn't let them have. I agree Google needs an eye kept on the
167.
by agwa 2y ago
Ad revenue declines without 3P cookies[1]. Safari and Firefox have less market share than Chrome and aren't made by a giant advertising company so they don't attract the same scrutiny. When Google tries to restrict 3P cookies it
168.
by agwa 2y ago
I'm not aware of any functionality in Chrome that allows Google to get tracking data that other ad providers can't, but it seems like regulators should target that instead of preventing Chrome from banning third-party cookies.
169.
by agwa 2y ago
> Or just get rid of cookies and let ad tech be less invasive. They tried to get rid of third-party cookies and regulators wouldn't let them do that.
170.
A new path for Privacy Sandbox on the web(privacysandbox.com)
108 points by agwa 2y ago|66 comments
171.
by agwa 2y ago
What would your pitch to donors be? Let's Encrypt was transformative by combining free and automated. Would your registrar be doing anything besides subsidizing domains for people who are willing/able to pay $9.15 (.com price wit
172.
by agwa 2y ago
PIR is owned by the Internet Society, a 501(c)(3) nonprofit which does a bunch of other stuff, like running the IETF. Most of the Internet Society's revenue comes from selling .org domains.
173.
by agwa 2y ago
That's becoming a registr y not a registr ar It's significantly more complicated and expensive. https://newgtldprogram.icann.org/en
174.
by agwa 2y ago
Yes, according to https://login.gov/partners/
175.
AB 1637 requires all cities and counties to transition to a .gov domain(californiacitynews.org)
41 points by agwa 2y ago|35 comments
176.
by agwa 2y ago
Statement from a spokesperson in the last paragraph of https://www.theregister.com/2024/06/28/google_axes_entrust_o... It doesn't say much.
177.
by agwa 2y ago
Representatives from the Chrome and Apple root programs participate in the Bugzilla discussions in an official capacity. But yes, there is significant help from the community in uncovering evidence and grilling CAs.
178.
by agwa 2y ago
I'm curious why that is. Is your API client using a root store that doesn't contain CAs other than Entrust, or pinning to an Entrust CA?
179.
by agwa 2y ago
CT was introduced to detect misissued certificates, but it was never intended to be used as a timestamping system like this. The point of the SCT timestamp was to start the clock on the deadline for the log to publish the certificate, not f
180.
by agwa 2y ago
What exactly does "time keeping abilities" mean? If I had to choose between 1) an NTP implementation with sub-millisecond accuracy that might allow a remote attacker to execute arbitrary code on my server and 2) an NTP implementa

More ›