News for hackers. Stuff that matters.

A comment on No, don't enable revocation checking.

Re:No, don't enable revocation checking by hereonbusiness on Sunday April 20, 2014 @07:00AM (#7616454)
So this complete infrastructure is crap. OpenSSL, a software half the internet uses but no one cares about because it's crap. CA's not revoking keys even though they know they're compromised. Revocation being worthless because it's too much of a hassle for anyone to bother.

Great. Maybe now, when half the internet is already compromised and all our certificates are not worth the bytes they're made of ... maybe we should try to come up with something better.

edit: Actually, this whole heartbleed affair has been quite eyeopening for me, so I'm thankful for that. But it certainly didn't help with the paranoia I feel the last couple of years while using services on the internet.

[ Parent | on HN ]
Re:No, don't enable revocation checking by tptacek on Sunday April 20, 2014 @12:30PM (#7617378)
Yes! Now it's time for us to generate a whole new broken infrastructure! I'm sure if we just rewrite all the Internet's crypto in Rust, everything will be great 10 years from now. No way will a radically different new transport cryptosystem grant researchers 100 new bugs to play with; after all, we'll have option types.
[ Parent | on HN ]
Re:No, don't enable revocation checking by lucian1900 on Tuesday April 22, 2014 @04:59AM (#7626504)
You're right to mock the attitude people have that the only thing wrong with OpenSSL is the language it's written in, but memory unsafety has nevertheless been a factor in many security flaws.
[ Parent | on HN ]
Re:No, don't enable revocation checking by hereonbusiness on Sunday April 20, 2014 @08:54PM (#7619121)
I'm no security expert but I guess there could be ways to keep TLS as a protocol more or less unchanged while fixing the obviously broken stuff surrounding it.
[ Parent | on HN ]
Re:No, don't enable revocation checking by cpeterso on Sunday April 20, 2014 @09:27PM (#7619231)
Don't forget that 90% of the world's certificates are issued by five commercial CAs, who happen to be friendly with various national security agencies.
[ Parent | on HN ]