News for hackers. Stuff that matters.

A comment on No, don't enable revocation checking. Parent comment

Re:No, don't enable revocation checking by ars on Sunday April 20, 2014 @01:31PM (#7617643)
I guess you didn't read the article? He's saying there are no cases where it works. Making it completely pointless.
[ Parent | on HN ]
Re:No, don't enable revocation checking by millerc on Sunday April 20, 2014 @01:43PM (#7617688)
> That's why I claim that online revocation checking is useless - because it doesn't stop attacks.

Doesn't mean there are "no" cases where it works. It just means any attacker dedicated enough can work around the CRLs.

I don't see any reason why one should throw the baby with the water. In this case, I just see Chrome guilty of FUD and hiding behind an intractable problem to justify their incorrect position.

See http://en.wikipedia.org/wiki/Two_Generals'_Problem if you want to convince yourself the problem is intractable.

[ Parent | on HN ]
Re:No, don't enable revocation checking by Splendor on Sunday April 20, 2014 @02:42PM (#7617963)
I did read the article.

> "In order to end on a positive note, I'll mention a case where online revocation checking does work..."

[ Parent | on HN ]
Re:No, don't enable revocation checking by lallysingh on Sunday April 20, 2014 @03:25PM (#7618141)
Funny how you didn't quote the actual case mentioned, just the text ahead of it. Ctrl-F'ing a little quick, eh?
[ Parent | on HN ]
Re:No, don't enable revocation checking by ars on Sunday April 20, 2014 @03:16PM (#7618108)
That's even more proof you didn't read it. How does enabling it in chrome make any difference to code signing?
[ Parent | on HN ]
Re:No, don't enable revocation checking by Splendor on Sunday April 20, 2014 @04:13PM (#7618316)
Does enabling revocation checking make me less safe?
[ Parent | on HN ]
Re:No, don't enable revocation checking by tptacek on Sunday April 20, 2014 @04:31PM (#7618373)
Yes! It involves you reporting all the sites you visit to a CA!
[ Parent | on HN ]
Re:No, don't enable revocation checking by Splendor on Sunday April 20, 2014 @05:56PM (#7618626)
I guess I knew that but hadn't grasped the security problem this presents. You've changed my mind. Thank you.
[ Parent | on HN ]