News for hackers. Stuff that matters.

A comment on All extensions disabled due to expiration of intermediate signing cert.

Re:All extensions disabled due to expiration of intermediate... by M0 on Friday May 03, 2019 @11:05PM (#19824127)
They don't use cryptographic timestamps with their signatures ? The certificate might now be invalid, but the signatures were done at a time when it was valid...
[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by fluidcruft on Saturday May 04, 2019 @12:20AM (#19824413)
The problem is that "time" is fungible and can be forged. The date on a signature doesn't really mean anything.
[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by altfredd on Saturday May 04, 2019 @01:50AM (#19824706)
This is a very bizarre justification for an obvious bug. Code-signing does not work that way anywhere else — neither in Android, nor on iOS, Windows or any other common platform.

There is a possibility that Mozilla implemented their backwards code-signing model on purpose — for example, it allows them to oust unwanted extensions without explicitly recalling their certificates. But personally I think that they just didn't give the matter enough thought.

[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by userbinator on Saturday May 04, 2019 @12:36AM (#19824479)
Emphasis on cryptographic timestamps.
[ Parent | on HN ]