Hacker News Reader

Comment by tptacek | Hacker News Reader

It is genuinely weird to think Microsoft should get a veto over your browser if that browser stops trusting a CA, right?

View on HN

The only thing that is genuinely weird is having four different certificate stores on a system, each with different trusted roots, because the cabals of man-children that control the WebPKI can't set aside their petty disagreements and reach consensus on anything.

Which makes sense, because that would require them all to relinquish some power to their little corner of the Internet, which they are all unwilling to do.

This fuckery started with Google, dissatisfied with not having total control over the entire Internet, deciding they're going to rewrite the book for certificate trust in Chrome only (turns out after having captured the majority browser market share and having a de-facto monopoly, you can do whatever you want).

I don't blame Mozilla having their own roots because that is probably just incompetence on their part. It's more likely they traded figuring out interfacing with OS crypto APIs for upkeep on 30 year old Netscape cruft. Anyone who has had to maintain large scale deployments of Firefox understands this lament and knows what a pain in the ass it is.

that’s not what he meant, and you know it. he means use the OS store (the one the user has control over), instead of having each app do its own thing (where the user may or may not have control, and even if he does have it, now has to tweak settings in a dozen places instead of one). they try to pull the same mess with DNS (i.e. Mozilla’s DoH implementation)

I don't understand, because the user has control over the browser store too.

(As an erstwhile pentester, btw, fuck the OS certificate store; makes testing sites a colossal pain).

> I don't understand, because the user has control over the browser store too.

i already mentioned that ("may or may not"). former or latter, per-app CA management is an abomination from security and administrative perspectives. from the security perspective, abandonware (i.e. months old software at the rate things change in this business) will become effectively "bricked" by out-of-date CAs and out-of-date revocation lists, forcing the users to either migrate (more $$$), roll with broken TLS, or even bypass it entirely (more likely); from the administrative perspective, IT admins and devops guys will have to wrangle each application individually. it raises the hurdle from "keep your OS up-to-date" to "keep all of your applications up-to-date".

> As an erstwhile pentester

exactly. you're trying to get in. per-app config makes your life easier. as an erstwhile server-herder, i prefer the os store, which makes it easier for me to ensure everything is up-to-date, manage which 3rd-party CAs i trust & which i don't, and cut 3rd-parties out-of-the-loop entirely for in-house-only applications (protected by my own CA).

It's baffling to me that anyone would expect browsers to make root store decisions optimized for server-herders. You're not their userbase!

neither are pentesters

Right, I don't think the pentester use case here is at all dispositive; in fact, it's approximately as meaningful as the server-herders.

> (As an erstwhile pentester, btw, fuck the OS certificate store; makes testing sites a colossal pain)

Can you please explain? I'm just curious, not arguing.

It's a good question! When you're testing websites, you've generally got a browser set up with a fake root cert so you can bypass TLS. In that situation, you want one of your browsers to have a different configuration than your daily driver.

Reply on news.ycombinator.com