News for hackers. Stuff that matters.

A comment on Encrypted traffic interception on Hetzner and Linode targeting Jabber service. Parent comment

Re:Encrypted traffic interception on Hetzner and Linode targ... by agwa on Friday October 20, 2023 @01:48PM (#37959257)
It may be better for the XMPP ecosystem to focus on increasing adoption of channel binding rather than CT enforcement. I wrote briefly about the challenges faced by non-browser clients at <https://news.ycombinator.com/item?id=36436303> but the tldr is that all SCT-checking clients have to be able to respond to ecosystem changes very quickly. This is so important that Chrome and Safari both disable SCT checking entirely if the browser hasn't been updated in more than 10 weeks.

Feel free to contact me (email in profile) or ask here if you want to talk more about this. I use XMPP (thank you for Prosody!) and have been involved in the CT space for many years now.

[ Parent | on HN ]
Re:Encrypted traffic interception on Hetzner and Linode targ... by aaomidi on Friday October 20, 2023 @02:29PM (#37959733)
> but the tldr is that all SCT-checking clients have to be able to respond to ecosystem changes very quickly.

This is fine. If you're using a tool that's connecting to the internet, you probably need to monitor for updates anyway.

I'd like to see a separate package, similar to Mozilla's `ca-certificates`, but for CT that can be updated independently of the actual useragent.

[ Parent | on HN ]
Re:Encrypted traffic interception on Hetzner and Linode targ... by agwa on Friday October 20, 2023 @02:46PM (#37959907)
> This is fine. If you're using a tool that's connecting to the internet, you probably need to monitor for updates anyway.

People should do this, but in practice it often doesn't happen - as witnessed by the Appmattus library fiasco earlier this year.

> I'd like to see a separate package, similar to Mozilla's `ca-certificates`, but for CT that can be updated independently of the actual useragent.

Considering how slowly updates to the various ca-certificates packages propagate, this would be absolute disaster for CT.

[ Parent | on HN ]