Standing on our own two feet

Re:Standing on our own two feet by WorldMaker on Friday November 06, 2020 @12:46PM (#25009517)

Root certificate updates are a massive security issue. Blaming Let's Encrypt is blaming one of the canaries for the coal mine disaster. 33% of Android devices don't and can't get up to date root certificates is an impressive security crisis that grows worse by the year (look at the other root expirations and the crazy workarounds that for instance Netflix has been doing to still work on older Android devices). Shouldn't the blame squarely be on Google, the Android OEMs, and the phone carriers for allowing this disaster to happen in the first place?

I realize that is a tough message to get out to users and site owners are going to be in the cross-fire, but it seems better to try to work for solidarity in pointing fingers at the right direction and the right direction certainly isn't Let's Encrypt.

[ Parent | on HN ]

Re:Standing on our own two feet by est31 on Friday November 06, 2020 @01:29PM (#25009931)

Yes the issue is really severe of most deployed Android devices not getting security updates, either at all, or the devices are used well beyond the update period.

But this is not up to Let's Encrypt to solve. They market themselves to build products for the mass market instead of small niches of the market, say, everyone who buys a new phone every year. But then they also have to treat their product like a mass market product, and if Android users still use older versions of the OS, then Let's Encrypt should adopt for that.

[ Parent | on HN ]

Re:Standing on our own two feet by thayne on Friday November 06, 2020 @11:33PM (#25013240)

This problem isn't unique to Let's Encrypt. Let's Encrypt is not the only entity with certificates signed by DST Root X3. And as these devices get older, more root certificates will expire. What happens when all of them expire?

What is unique about Let's Encrypt, is they may have a harder time getting cross-signed by a CA that will still have a valid root cert on these devices for a significant amount of time, because, as has been pointed out in other comments, Let's Encrypt is disrupting the CA industry.

[ Parent | on HN ]

Re:Standing on our own two feet by jacquesm on Friday November 06, 2020 @03:28PM (#25010813)

They will be happy to accept that blame, as long as you fork over your $ for a new device. Planned obsolescence can have many components, this is just one of them.

[ Parent | on HN ]

Re:Standing on our own two feet by cpach on Friday November 06, 2020 @01:00PM (#25009660)

That makes me curious, what workarounds did Netflix employ?

[ Parent | on HN ]

Re:Standing on our own two feet by WorldMaker on Friday November 06, 2020 @01:13PM (#25009764)

It was the BBC I was actually thinking about, and it's a part of this article (which also mentions this Let's Encrypt root change):

https://scotthelme.co.uk/impending-doom-root-ca-expiring-leg...

Previous HN discussion on that article: https://news.ycombinator.com/item?id=23455463

[ Parent | on HN ]

Re:Standing on our own two feet by Aissen on Friday November 06, 2020 @01:06PM (#25009707)

When you control the client, it's simple, you can do pretty much anything: embed your own HTTP stack, TLS stack, your QUIC stack, or simply your PKI, or subset of the webPKI.

[ Parent | on HN ]