Hacker News Reader

Comment by nitrogen | Hacker News Reader

Would it be possible to use a probabilistic data structure (e.g. Bloom filter) to create a privacy-enabled CRL as a service?

View on HN

I don't see why not, especially because you already have the old key signature/fingerprint to use when pushing it into the Bloom filter. Seems like a perfect case for it, actually.

You could distrust any certificate that was signed before April 7 (or some slightly later date). It might be easier to do that and whitelist the good "pre-apocalypse" certificates. The nice thing about doing this is that your whitelist will inherently go to zero as certificates time out and get renewed (typically 1-3 years?).

The hard thing would be to generate an accurate whitelist.

We had certs that were only used and present on machines that were not vulnerable, and therefore did not replace or revoke them. Please don't do this.

Furthermore servers that weren't even using OpenSSL or the particular version(s) that were susceptible. What is the actual percentage of servers that needed to react to this?

I dunno... Probably worth it from a netsec point of view.

Doesn't work, since rekeyed certificates are often (mostly?) backdated to have the same valid-from date as the old certificate.

I updated my key and certificate, and for the browser-visible certificate metadata only the fingerprint changed.

For all that you've heard about the disaster side, there's also a huge number of sites that weren't affected. Whitelisting wouldn't help much.

Reply on news.ycombinator.com