Microsoft Follows Mozilla In Considering Early Ban On SHA-1 Certificates (csoonline.com) 47
itwbennett writes: Following the first successful collision attack on the SHA-1 hashing algorithm last month, Mozilla said that it was considering a cut-off of July 1, 2016 to start rejecting all SHA-1 SSL certificates, ahead of an earlier scheduled date of Jan. 1, 2017. And now Microsoft is considering blocking the hashing algorithm on Windows by June next year.
Kickstarter (Score:3)
If it really is only $75-120K to crack SHA1, I propose we start a Kickstarter to gather the funds. Given the estimate of a few months, we'll ship our SHA1 collision well before a lot of other Kickstarter projects ship their products :)
Re: (Score:1)
If the statement "first successful collision attack" were true, then I would put money into that Kickstarter.
But, if you follow the links, you'll find that they only partially succeeded on the collision in just the compression section of SHA-1. There's a lot more work to be done to make this into an actual SHA-1 collision. Their estimate of a full collision by the end of the year is overly optimistic.
The Kickstarter would have some cash, that would be quickly drained without a full collision in sight. So
Overrides (Score:5, Insightful)
At least let me fucking override shit for my devices (UPSes, copiers, etc.) that have absolutely no ability to use anything other than the self-signed shit they come with.
I'm fine with warning or blocking by default, but when those idiots remove my ability to do what I need to do (whitelist) I end up having to keep an older version of the browser with more holes in it just to connect to this UPS, that switch, this copier, etc.
Re: (Score:2)
Re: (Score:2)
I have this problem with devices that need older versions of Java. I keep around a Win 2003 VM just to be able to use web interfaces for some old production hardware that the business doesn't want to pay to replace until it dies.
Forced to click through (Score:4, Informative)
My experience of these changes is that you'll be forced to click through a warning in your browser even if you installed the certificate (or the root CA signing the certificate). The Microsoft page about no longer trusting SHA1 certs is confusing in this respect [microsoft.com] because it includes information about signing Windows binaries but it does say
Windows [...] will no longer trust any code that is signed with a SHA-1 code signing certificate and that contains a timestamp value greater than January 1, 2016
That document also says it only applies to certs that are in the Microsoft Root Certificate Program [microsoft.com] so ones you've manually installed might not be affected.
This is slightly different to the Mozilla's SHA-1 deprecation information [mozilla.org]:
After January 1, 2017, we plan to show the “Untrusted Connection” error whenever a SHA-1 certificate is encountered in Firefox.
Perhaps this isn't the override you were thinking of but it doesn't sound like a total block.
Re:Overrides (Score:5, Informative)
Re: (Score:1)
There are also a few paid ones available.
Do this would provide a greater level of security.
Re: (Score:2)
Those sorts of people should just install one of the free VM products (QEMU (linux) [qemu.org] Virtual PC (Windows) [microsoft.com]) available for their machine, install the os and only use it when required. There are also a few paid ones available. Do this would provide a greater level of security.
ranks of people holding on to WinXP virtual machines
It's not quite so bad as you think, then :)
Re: (Score:1)
Re: (Score:2)
All of them is the short answer. I have at work a myriad of browser version to deal with embedded management devices that no longer work with modern browsers. The latest is that my 3.5 year old Dell C6100's all still under maintenance won't work with either Chrome or Firefox (shitty SHA1 only it appears), and there is no update from Dell. I also have a range of Sun/Oracle kit again still all under maintenance, and again all does not work. The Sun/Oracle kit is the biggest joke as I have to maintain random o
Re: (Score:3)
APC SmartUPS
Dell PowerConnect switches
HP switches (forget the name of the line)
Canon, Konica, and Xerox copiers
Etc.
These types of things are in place for decades, and all require some sort of ancient voodoo tool chain to fully manage.
Lord help you if you need to connect to an old UPS or switch via serial. 99 times out of 100 you won't have a serial port on any convenient device, the UPS to serial adapters only work half the time even when you can figure out the specific settings for the device, and then yo
Re: (Score:3)
Re: (Score:2)
That's exactly what I do.
But I need multiple versions for different pieces of shit.
Re: (Score:3)
Re:git (Score:4, Insightful)
No, this only affects SSL certificates using the SHA-1 hash. Git isn't using the SHA-1 hash in a way where generating a collision would have security risks so there is no reason why anything has to change for Git.
Re: (Score:2)
Re: (Score:1)
if (uid == 0)
to
if (uid = 0)
I CAN'T BELIEVE YOU POSTED THIS 0-DAY CODE ON HOW TO MITM SHA1! Did you even BOTHER to notify the correct people and give them the 90 days to correct such a mistake??
Try not to be misguided (Score:5, Insightful)
It's fine rejecting insecure certificates but sometimes, I'd rather have browsers get their priorities in order.
If you go on a SSL website that uses a self-signed certificate or use a slightly outdated one, you are presented with a scary warning page with multiple clicks needed to get to it. However, plain HTTP goes right through even though it is less secure than SSL with any bogus certificate.
Instead of a ban, I'm all for a rating system, like :
- Strong : everything OK, strong crypto
- Medium : slightly outdated, weaker crypto (SHA-1 could be on this level)
- Weak : self-signed, completely outdated
- None : HTTP
- Dangerous : revoked, mismatched certificate, suspect behavior (such as a decrease in security from last visit)
Only the "dangerous" category should trigger a warning, for the other categories, a different "lock" icon should be sufficient. Like the crossed-out "https" in Google Chrome.
Re: (Score:1)
Re: (Score:3)
Re: (Score:2, Insightful)
Re: (Score:2)
Re:Try not to be misguided (Score:4, Insightful)
Indeed but posting sensitive data unencrypted is even worse and the browser won't say anything about it.
The problem is that the browser has no simple way of knowing if the site is sensitive or not. The best it can do is to tell you clearly about the level of security so that you can react accordingly.
"Dangerous" would be "worse that unencrypted" and should be reserved for cases where an attack is strongly suspected, cases where the error is unlikely to be simply the result of poor maintenance (outdated) or not wanting to deal with certificate authorities (self-signed).
Also note that the examples I gave are not necessarily the best. The true conditions should be determined by actual data. But, I sometimes see myself going to the http version of a (non sensitive) site to avoid the warning, that's retarded and browsers shouldn't encourage this behavior. Also, wanting to visit a broken https site once doesn't mean I want to add an exception forever.
Re: (Score:2)
The problem with the lock icon and similar things is it arrives too late. By the time the user sees it they have already interacted with the server and potentially sent it sensitive information.
Consider for example a login form on https://foo.mycorp.com/ [mycorp.com] that submits the login details to https://bar.mycorp.com/ [mycorp.com] .
Re: (Score:2)
Re: (Score:2)
Mozilla is working on that:
https://blog.mozilla.org/secur... [mozilla.org]
Re: (Score:2)
Rule of thumb, wrong information is always the worst kind of information, even more than no information.
Safari 9 on the Mac... (Score:3)
...has a menu option in the develop menu for "Treat SHA-1 Certificates as insecure." Nice having the flexibility to turn that on and off depending on need.
What about SHA2 support for DHE? (Score:2)
Firefox only currently supports DHE with SHA1. Are they going add support for SHA256 DHE when they disable SHA1?
To quote Michael Staruch from the above link:
It looked more like attempts to discredit DHE and push everyone into ECC. And I am not so sure if that's best way to protect our privacy, especially with multiple TLS clients supporting only NSA Suite B curves.
Mozilla, we really need DHE to work with SHA256 and GCM. Sure, fallback to something else (with a se