- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
so each firefox version has a fixed expiry date
|
| Author | Content |
|---|---|
| mbaehrlxer Sep 27, 2016 1:10 AM EDT |
that is kind of worrying. Free Software should not have a known expiry date. sure, when security issues are found you ought to upgrade. but this is not just a hard to spot bug, because that implies that it can be fixed. when a security issue is fixed, i upgrade once, and the issue is gone for good. but this is a built-in design-flaw that activates at a known time and can never be properly fixed. it can only be worked around by upgrading. and with every upgrade the issue comes back, it's just that each upgrade delays the date when that issue becomes a problem. Quoting: WARNING: your browser expires on dec 15, 2016. after that day, your TLS communication is no longer secure. (ok, that's a bit polemic, because it only applies to sites that don't dynamically update their pins, but you get the idea) what i am wondering is, once the pin expires, is there any kind of warning to that effect? if i understand the issue correctly: go to a site for the first time. load the certificate. preloaded pin ensures that certificate is authentic. connection to this site should be trustable until the pin AND the certificate itself expire. as long as the pin is valid, certificate changes are trusted. once the pin expires, already loaded certificates are still trusted, but further certificate changes are no longer trusted. so that, even after the pin expires, the already loaded certificates are fine, and only when both are expired, then trouble starts. it seems to me that updating a security certificate needs to become a two step process. and if i think about it, such a process makes sense: * website sends a certificate. certificate is verified with browser pin. * before certificate expires, website sends a new pin, that is valid long enough until the new certificate is available. * browser accepts pin because it is sent from a trusted site. * browser validates new certificate based on the pin it received. * website sends new certificate signed with old certificate. greetings, eMBee. |
| flufferbeer Sep 28, 2016 7:27 PM EDT |
@mbaehrlxer > Free Software should not have a known expiry date... I realize this isn't really related at all, but HP's (Free? non-free?) Firmware has an expiry date that is DECIDELY preventing bona fide HP printer owners from using cheaper third-party ink cartridges! http://arstechnica.com/information-technology/2016/09/hp-sho... $heesh, what an incredibly lousy M$-like tactic!! 2c |
| dotmatrix Sep 28, 2016 8:11 PM EDT |
@mbaehrlxer:
It seems the vulnerability discussed in the article is two pronged and specific to the Mozilla add-on site. Both the Mozilla add-on site and the Mozilla client browser needed updating. The Mozilla add-on site was doing 'pinning' but, apparently, not per specification. And, I guess, the Mozilla browser was written to accommodate the 'incorrect' pinning... which led to a security vulnerability when Mozilla's server pins {and only Mozilla's pins} expired. I guess... it's somewhat difficult to understand the whole issue at first reading. *** My personal opinion of 'pinning' is that it's security done wrong to begin with... If your server has been compromised, so have your pins. A better way would be to put a public key in DNS and protect the DNS entry via DNSSEC. |
Post a reply to this thread:
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post