Hacker News Reader

Comment by ottah | Hacker News Reader

Mmmm, great that and mandatory key rotation every 90 days, plus needing to get a cert from an approved CA, means just that more busy work to have an independent web presence.

I don't like people externalizing their security policy preferences. Yes this might be more secure for a class of use-cases, but I as a user should be allowed to decide my threat model. It's not like these initiatives really solve the risks posed by bad actors. We have so much compliance theater around email, and we still have exactly the same threats and issues as existed twenty years ago.

View on HN

You understand that key rotation can and should be automated, right?

It adds complexity, more points of failure, and ensures that more legacy services will go offline needlessly. While almost certainly not actually improving the actual security issues the average user experience. Lack of a valid tls certificate is usually not the reason people are victims of crime online.

HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer.

> I as a user should be allowed to decide my threat model

Asking you if you want to proceed is allowing you to decide your threat model.

> We have so much compliance theater around email, and we still have exactly the same threats and issues as existed twenty years ago.

...and yet we have largely eliminated entire classes of issue on the web with the shift to HTTPS, to the point where asking users to opt-in to HTTP traffic is actually a practical option, raising the default security posture with minimal downside.

> HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer.

A lot of this discussion is about how the browsers define their security requirements on top of HTTPS/TLS/etc.

Such as what CAs they trust by default, and what’s the maximum lifetime of a certificate before they won’t trust it. I believe it is now 2 years? Going even lower soon.

They don't require key rotation, though, merely certificate busy work; if they wanted key rotation they could try to add some mechanism for it, but I've been using the same key for over a decade now.

Well HTTPS the protocol might not, but the implementation is essentially going that way https://www.digicert.com/blog/tls-certificate-lifetimes-will...

As someone who has run email servers, I can guarantee you none of this is theater. If you remove all the anti-spam backing, email becomes a useless service. At least the kind of 'accept mail from anyone' smtp thing we all decided to standardize on.

This is all automatable and is well documented for almost every setup. If you're on a cloud provider/CDN it's even easier as they'll handle all this for you at pretty much no cost.

You can also still use your own threat model. You can use self-signed certs, import your own CA, etc. The issue is that browsers need to service the mass market, including the figurative grandma who won't otherwise understand fake bank certificates.

As for email, yes...that is a complete shitshow and I'm still surprised it works as well as it does.

I guarantee you that your grandmother will still get phished with a valid domain certificate.

Impressive. I don't need to post my opinion on this anymore - you did it so much better than I ever could.

Reply on news.ycombinator.com