Hacker News new | past | comments | ask | show | jobs | submit
post-it | on: eMudhra to exit global SSL/TLS certificate business
Yes, but in the end that's not their fault, and in a sense it's good that this happened. It was well understood from the invention of security certificates that private keys might leak and certificates will need to be revoked. Systems that were not designed with this in mind should never have been deployed, and should now be decommissioned and replaced.

It might even be sensible to intentionally revoke a small number of certificates every month, to make sure nobody is complacent.

ryukoposting | parent | next
The number of awesome things we're going to get as a result of this is exciting to think about.

My wife bought this fuckass IoT air purifier that's constantly phoning home. I'm gonna figure out what it's telling the mothership.

loading story #50196920
paimapi | root | parent | next
This reminds me - I need to get around to setting up a PiHole and convince my partner that her freemium mobile games aren't necessarily worth the telemetry scrapes.
loading story #50197070
loading story #50202376
loading story #50197254
loading story #50198672
loading story #50196951
throw0101c | parent | next
> Yes, but in the end that's not their fault, and in a sense it's good that this happened.

I am reminded of the US DST changes back in the 2000s: there was all sorts of drama because a lot of software is written in the US, and there was much 'computerization' in the 1990s, but US coders had never personally experienced a DST rule change during that time period, so any change needed a reboot to pick up the new rules.

That drama led to (e.g.) periodic dynamic checking of /etc/localtime on various Unix-y system.

Sometimes you don't realize that things can be improved until you experience situations in which they currently suck.

loading story #50196760
loading story #50196360
hobofan | parent | next
Kind of what Let's encrypt did for automating certificate rotation.

Let's call it "Let's Decrypt!"

loading story #50197319
Zobat | parent | next
Google has decided to stop trusting certificates with dual purpose (server and client) and managed to negotiate a decrease in the maximum (SSL/TLS) certificate lifetime because certificate revocation doesn't work.

We've had to rework part of our application and certificate use because of this.

thayne | parent | next
Yes, well, PKI was originally designed when distributed lists of revoked certificates was somewhat practical (due to much smaller scale).

Now we are in a situation where we don't really have a practical and correct way to revoke certificates, but many, many things depend on pki.

hluska | parent | next
> It might even be sensible to intentionally revoke a small number of certificates every month, to make sure nobody is complacent.

No, this is not even remotely sensible.

loading story #50196207
loading story #50196750
loading story #50196220
shadowgovt | parent
Honestly, that's not a bad idea at all. That's exactly the kind of thing that companies like Google do in disaster recovery testing.

If you don't know if you can hot-swap your certs, you probably can't.