Conversation

Notices

1. Embed this notice
   Jerry on Mastodon (jerry@hear-me.social)'s status on Wednesday, 20-Aug-2025 03:57:29 JST Jerry on Mastodon

   This is a very good thing! And it will be available for other browsers to use.

   https://blog.mozilla.org/en/firefox/crlite/

   #Firefox #certificates #revocation

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Wednesday, 20-Aug-2025 03:59:32 JST Rich Felker

     in reply to

     @Jerry I mean for once it doesn't seem bad (do you have to trust the authority claiming certs are revoked tho?) but just disabling CRL support entirely is perfectly fine for practical purposes. That's the whole point of the modern requirement that certs be short-lived.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Wednesday, 20-Aug-2025 04:01:49 JST Rich Felker

     in reply to

     @Jerry Like, of example.com has been compromised, I'm much more concerned about the compromise of whatever data they were storing about me than the theoretical possibility that the attacker who compromised them also has a position to MITM my connection within 1-3 months after the compromise.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Wednesday, 20-Aug-2025 04:09:15 JST Rich Felker

     in reply to

     @Jerry What I'm asking is if the revocations are verifiable client-side (this would require the full signature from the revoking party) or if you have to trust that the site you're downloading them from verified them.

     In the latter case, the threat of that site being forced to report a false revokation for a site a state authority wants to shut down is orders of magnitude worse than the threat of continuing to trust a compromised cert for some site (where the risk of further damage is basically zero, because the damage was already done when the attacker compromised the site and got all the data they held on me).

   • Embed this notice
     Jerry on Mastodon (jerry@hear-me.social)'s status on Wednesday, 20-Aug-2025 04:09:16 JST Jerry on Mastodon

     in reply to

     • Rich Felker

     @dalias
     True. But short-lived certs aren't going to be enforced, I think, for 3 more years? And still it will be 47 days. So, this is good to have an immediate revocation.

     I think only Firefox-trusted CAs can issue a revocation, so there shouldn't be a trust issue when receiving a revocation.