NFX posted:

I have a question about certificate transparency logs. as far as I can tell CAs only need to submit a pre certificate to the log, and that's what they usually do (according to wayne's comment some pages back).

what mechanism ensures that the CA then issues a certificate that matches the pre-cert? as far as I can tell that's entirely up to the client?

I suppose there's no other place to put the responsibility (and a cert that's never seen by a client is pointless anyway, regardless if it's malicious or not), but it seems like something that could be prevented by requiring the issued cert to be logged

Raymond T. Racing posted:

CA sends precert to CT, CT sends back SCT, CA gives subscriber cert+SCT from CT

NFX posted:

yes, but if subscriber and CA are in on it together to maliciously issue a cert for google.com, can't they issue a precert for foo.com, get an SCT, and use that to generate a google.com cert? then it's up to the client to verify that SCT and the precert are valid and match the cert for google.com. obviously that's no worse than the client needing to validating the cert itself, but it does mean that any discrepancy is only noticed at time of use, and as far as I can tell, only if client uses chrome/safari

e: obviously that would be super risky and probably burn the CA, but it might possibly be worth it in some highly targeted scenario. I assume the answer to my original question is "the CAs don't wanna do the extra work, politics, perfect is the enemy of good, etc. etc", I just wanted to know if there was something I have missed in my understanding of CT

Celexi posted:

love how certificate infrastructure is held up by some random corps and people to follow some rules that are as enforceable as a monopoly game rules and that most browsers and os stopped checking for cert revokations.

i mean it says there at top secure!!!

Celexi posted:

most browsers and os stopped checking for cert revokations.

Zamujasa posted:

most people do not expect every public location they are in to have someone recording their every move to be sold to one of the shittiest websites on the planet

there's plenty to be said about how discord enables this with infinite message history for everyone who joins, but that doesn't mean this behavior should be seen as normal or good

Wiggly Wayne DDS posted:

they'll be getting mixed up with CRLs getting de-prioritised in general and not checked in firefox entirely given OCSP is the norm

dr. Sándor SZŐKE posted:

Incident Status Report - 2024-04-24
Timeline
2024-04-24
based on Wayne's recent post we give the serials of the affected certificates to be easier to check the revocation status on CRL

Wiggly Wayne DDS posted:

they'll be getting mixed up with CRLs getting de-prioritised in general and not checked in firefox entirely given OCSP is the norm

also post got approved: https://groups.google.com/u/1/a/mozilla.org/g/dev-security-policy/c/J3aX8OKIT_A

Wiggly Wayne DDS posted:

i did a spittake btw:
Microsec: Misissuance an EV TLS certificate without CPSuri

they then provide to give a breakdown on every cert for: intermediary, revocation time, reason, etc for every certificate crt.sh id/serial pair

Wiggly Wayne DDS posted:

i did a spittake btw:
Microsec: Misissuance an EV TLS certificate without CPSuri

they then provide to give a breakdown on every cert for: intermediary, revocation time, reason, etc for every certificate crt.sh id/serial pair

Raymond T. Racing posted:

the sct for the pre-cert is over the entire cert

if CA sends foo.com to CT, they'd get back a SCT over foo.com, and if they blasted it into google.com and issued it, they'd end up with an invalid SCT

Raymond T. Racing posted:

I see we have some good nothing burger updates from our friends

Subjunctive posted:

I’m threatening you with revenue

Raymond T. Racing posted:

now this is what an incident report should look like jfc

akadajet posted:

I trialed admin by request for my it dept and it was a huge piece of poo poo

Wiggly Wayne DDS posted:

i did a spittake btw:
Microsec: Misissuance an EV TLS certificate without CPSuri

they then provide to give a breakdown on every cert for: intermediary, revocation time, reason, etc for every certificate crt.sh id/serial pair

Quackles posted:

We have admin by request at our office.

Because it creates a temp admin account and doesn't use an existing one, it doesn't work with Visual Studio

psiox posted:

what went well:

redleader posted:

oh my god, that's why i can't force myself to read corpo speak and llm output: it's the same empty, hollow poo poo

Bruce Morton posted:

Update on the revocation progress:
13,053 certificates have been revoked or expired.
2,610 certificates have been re-issued with revocation pending.
731 out of 944 customer accounts have fully remediated the issue (certificates re-issued and old certificates revoked).

Bruce Morton posted:

Update on the revocation progress:
- 273 certificates have been revoked or expired.
- 26 certificates have been re-issued with revocation pending.
- 88 out of 114 customer accounts have fully remediated the issue (certificates re-issued and old certificates revoked).

HELLOMYNAMEIS___ posted:

"Sweden's liquor shelves to run empty this week due to ransomware attack"

TheFluff posted:

det här är inte riktigt den cyberpunkdystopin jag hade väntat mig

spankmeister posted:

Doobies Dog Certs, LLC

spankmeister posted:

Doobies Dog Certs, LLC

Bruce Morton posted:

Entrust voted in favor of the ballot as we did not have a reason at the time not to provide consensus. But to clarify, as noted above, we made three points on why we believe this to be an exceptional situation: 1) the lack of security risk, 2) the data showing minimal impact, and 3) that If the certificates were re-issued, they would be re-issued with the same certificate profile, resulting in the same certificate with a new issuance date.

It was weighing these three factors together that led us to this conclusion, not one factor by itself.

Bruce Morton posted:

Your question here goes to the series of incidents that we have posted in recent weeks. We have provided action items and assurances for each. In the best interests of our customers and the TLS ecosystem, our goal is to avoid mistakes and prepare our customers for future threats and mis-issuances, and in doing so to earn your trust.

Wiggly Wayne DDS posted:

wtf are entrust doing

Entrust: Failure to revoke OV TLS - CPS typographical (text placement) error



they .. were actively involved in proposing changes to the revocation timeline extension ballot and voted yes over 5 years ago. they're still making up exceptional situation rules to suit themselves. they're ignoring that they've been making these empty promises for years

Grace Baiting posted:

Grace Baiting posted:

Raymond T. Racing posted:

Jesus loving christ

how does the whole "motion to distrust" or whatever work

amir who do we need to talk to

quote:

Entrust voted in favor of the ballot as we did not have a reason at the time not to provide consensus. But to clarify, as noted above, we made three points on why we believe this to be an exceptional situation: 1) the lack of security risk, 2) the data showing minimal impact, and 3) that If the certificates were re-issued, they would be re-issued with the same certificate profile, resulting in the same certificate with a new issuance date.