News for hackers. Stuff that matters.
Re:Chrome’s address bar will use https:// by default by tsimionescu on Tuesday March 23, 2021 @03:32PM (#26559323)
Repeat every 3 months or whenever the root certs expire.
Re:Chrome’s address bar will use https:// by default by jodrellblank on Tuesday March 23, 2021 @05:05PM (#26560394)
3 months? I must have updated FireFox / Discord / VS Code /etc. about a hundred times in last 3 months. Plenty for them to add renewed SSL whatevers inside one of the updates.
Re:Chrome’s address bar will use https:// by default by Wowfunhappy on Tuesday March 23, 2021 @07:00PM (#26561438)
> 3 months? I must have updated FireFox / Discord / VS Code /etc.

I think this state of affairs is nuts. With the exception of Firefox, because web browsers have an inordinate number of security issues to contend with.

Re:Chrome’s address bar will use https:// by default by throwaway53453 on Wednesday March 24, 2021 @05:48AM (#26565227)
And other programs don't?
Re:Chrome’s address bar will use https:// by default by Wowfunhappy on Wednesday March 24, 2021 @12:40PM (#26569568)
An instant messaging client shouldn’t be executing arbitrary remote code, no.
Re:Chrome’s address bar will use https:// by default by throwaway53453 on Saturday March 27, 2021 @01:29PM (#26603846)
It's not really possible to prevent that. E.g. a well crafted image can easily trigger an RCE on some older versions of Android: https://nakedsecurity.sophos.com/2019/02/08/android-vulnerab...

Issues like this exist at all layers of the stack, so anything touching the internet needs regular security patches.

Re:Chrome’s address bar will use https:// by default by Wowfunhappy on Sunday March 28, 2021 @06:20PM (#26615248)
I agree completely. But, I also think that in most cases, if a simplistic piece of software like an IM app needs a security patch every three months, regularly, it's a sign the attack surface is too large.
Re:Chrome’s address bar will use https:// by default by upofadown on Tuesday March 23, 2021 @05:46PM (#26560776)
Why would the certs you create for this purpose be made to expire?
Re:Chrome’s address bar will use https:// by default by tim-- on Tuesday March 23, 2021 @08:13PM (#26562005)
It needs to expire before 397 days, because otherwise the CA will not be valid, even if it is marked as trusted. https://www.zdnet.com/article/google-wants-to-reduce-lifespa...

edit: a word

Re:Chrome’s address bar will use https:// by default by achew22 on Tuesday March 23, 2021 @09:17PM (#26562408)
The article you linked to is kind of confused and I'm not sure I blame them. This stuff is really complex!

According to the proposal[0], leaf certificates are prohibited from being signed with a validity window of more than 397 days by a CA/B[1] compliant Certificate authority. This is very VERY different from the cert not being valid. It means that a CA could absolutely make you a certificate that violated these rules. If a CA signed a certificate with a longer window, they would risk having their root CA removed from the CA/B trust store which would make their root certificate pretty much worthless.

To validate this, you can look at the CA certificates that Google has[2] that are set to expire in 2036 (scroll down to "Download CA certificates" and expand the "Root CAs" section) several of which have been issued since that CA/B governance change.

As of right now, as far as I know, Chrome will continue to trust certificates that are signed with a larger window. I've not heard anything about browsers enforcing validity windows or anything like that, but would be delighted to find out the ways that I'm wrong if you can point me to a link.

Further, your home made root certificate will almost certainly not be accepted by CA/B into their trust store (and it sounds like you wouldn't want that) which means you're not bound by their governance. Feel free to issue yourself a certificate that lasts 1000 years and certifies that you're made out of marshmallows or whatever you want. As long as you install the public part of the CA into your devices it'll work great and your phone/laptop/whatever will be 100% sure you're made out of puffed sugar.

I guess I have to disclose that I'm an xoogler who worked on certificate issuance infrastructure and that this is my opinion, that my opinons are bad and I should feel bad :zoidberg:.

[0] https://github.com/cabforum/servercert/pull/138/commits/2b06... [1] https://en.wikipedia.org/wiki/CA/Browser_Forum [2] https://pki.goog/repository/