Slashdot Mirror
No More SSL Revocation Checking For Chrome
New submitter mwehle writes with this bit from Ars Technica: "Google's Chrome browser will stop relying on a decades-old method for ensuring secure sockets layer certificates are valid after one of the company's top engineers compared it to seat belts that break when they are needed most. The browser will stop querying CRL, or certificate revocation lists, and databases that rely on OCSP, or online certificate status protocol, Google researcher Adam Langley said in a blog post published on Sunday. He said the services, which browsers are supposed to query before trusting a credential for an SSL-protected address, don't make end users safer because Chrome and most other browsers establish the connection even when the services aren't able to ensure a certificate hasn't been tampered with."
Why?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
So he admits Chrome is broken, so he doesn't fix it and blames the CA's . . makes sense.
So basically he wants CRLs? I thought he didn't want CRLs?
Your hair look like poop, Bob! - Wanker.
And the solution, obviously, is not checking at all. Slick.
All they're really doing is moving the certificate revocation checks from the client to the server; Google updates its own CRL and pushes it to Chrome so that the browser doesn't have to rely on potentially unresponsive 3rd party sites for its checks.
CRLs and OCSP are functionally useless. For PKI to work, certificate revocation must work also. Some kind of reliable system has to be constructed. Chrome is doing what they need to do to make this happen by abandoning the useless, outdated technologies of the past.
Before someone asserts otherwise, explain DigiNotar. While you are at it, explain all the rest of the CA compromises over the last two years. Then explain why each browser essentially had to distribute a patch to fix the problem rather than relying on OCSP and CRLs. If they are functional, that wouldn't have been necessary.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
X509 certificates go back to July 3, 1988.
That makes certificates (and their revocation) 24 years old.
So yes, decades old.
Except now Google is presenting itself as an authority on the status of certificates that it has no business doing so with to the users of chrome.
This is a bad thing.
because Chrome and most other browsers establish the connection even when the services aren't able to ensure a certificate hasn't been tampered with.
This is just a case of unsafe defaults. To fix this in Firefox go to Tolls - Options - Advanced - Encryption - Validation and check the box that says "When an OCSP server connection fails, treat the certificate as invalid."
This is probably what the default should be anyway. I cannot imagine a fingerprint scanner that just assumed everyone was authorized if the database went down. If it can't validate, then it isn't valid!
I harp on this constantly. At work, we fairly routinely issue people new certificates and revoke the old ones, even when there's no belief that the certs were compromised. As a result, you can send somebody an email and later that day get new certs. This is a problem because all the digitally signed emails you sent earlier now register as revoked and Outlook proceeds to tell you this, that the email can't be trusted, etc...
This happens frequently enough that I encounter this 2-3 times a week. The email has always been valid, they just got new certs between their sending the messages and my opening the email(possibly for historical reasons).
Same deal as with the california cancer warning - stick it on EVERYTHING, and it gets ignored. If you put cancer warnings on apples, they may not pay attention to the cancer warning on that bottle of test chemical.
I don't read AC A human right
Except now Google is presenting itself as an authority on the status of certificates that it has no business doing so with to the users of chrome.
This is a bad thing.
Google is already the authority which decides which CAs will be trusted by Chrome. How does it really change anything if Google also collects the CA CRLs and pushes them to the browser? Other than making revocations much more reliable.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Chrome: "We're not wearing eye-gear on the paintball field because we all shoot at torsos"
Banks: "That's nice. You're not playing on the paintball field without eye-gear."
I have been running with security.OCSP.require set to true for a long time and haven't really noticed failures. Maybe the stated problem with CRL check timeouts is being overblown?
A seat-belt isn't there to protect you if you drive at 200mph into the side of a building. If that's what you're doing, your day is going to be ruined no matter what.
Seat-belts are there to protect against the low hanging fruit of accidents. If you're driving 20mph and the neighbour's cat suddenly runs across the road, you break and the seat belt stops you and your passengers from getting a nasty bruise.
That's what it's for, and it works exceedingly well at doing that. If we get rid of seat-belts because they don't help in the 1% of cases, like when someone crashes into a building, then all we're doing is increasing dramatically the global accident rate on trivial incidents, like the cat example.