44 comments as I open the thread
4 options to disable
AUGH!!! IT’S A CONSPIRACY!!!
When you touch but(t)
Somebody just knocked on my door. I’m arming myself. Right now. 🔪
Are you arming your… forearms? FOREarms??? hahahHAHahaHAHAAAAHAHahaaaaHAHAAa!!!1!1!111eleventy
;-)
there’s 4 of them, coincidence or conspiracy?
Thats just how they remembered their private key
Well now you’ve put me on a list. Thanks.
I’ve never looked at this list before. Quite a large number of them. Is there any way for me to know which ones I shouldn’t have enabled?
Without having any specialized knowledge on the subject, I’d say, start frequenting cyber security forums, follow youtubers who cover such topics and just keep yourself up to date on matters cyber. Or start researching the CAs one by one.
If anyone else here uses AdGuard, the latest version of their app rejects the affected certificates. 👍
Thank is for the reminder.
4
4? That’s the kind of crypto key an idiot would use on his luggage!
4
Well, the post is exactly about the 4, so… yes.
FYI, G3 is the only one listed with the issue, the others are fine AFAIK. But if you don’t trust eMudhra at all after that, then that’s fair.
Edit: Actually it’s the intermediate certs that are compromised, the roots are still fine, but many of them come from the G3 root cert (and Sectigo’s AAA Certificate Services)
Oh, thanks for that! 😊 I just heard that they quit the TLS business all together.
Yeah, my understanding was they’re not issuing new certificates, but the current ones are still valid until they’ve expired.
Recently learned that root CA don’t actually expire. Yes, they have an expiration date, but nothing pays attention to it for a CA.
Well you can’t sign new certs (with the current date) with an expired root/intermediate cert, but the root/intermediate cert expiring doesn’t strictly invalidate the already signed certs.
But I was more talking about the end-user certificates in the previous comment.
They closed shop entirely, so there won’t be any new certs signed anyway
I once tried to disable all but the ones I actually need. There are close to 200 CAs trusted by my devices and I only need to trust about 15 of them. But it’s a colossal pain in the ass to figure out which CA an app needs, so I abandoned that experiment.
Yeah, I too had that ambition once, but I didn’t even know where to begin, since I don’t know how to find out which once my apps, websites and other services actually need. Other than investigating whole chains of collaboration between the various owners and devs of those services. Arduous much? 😅
I used a proxy to look up which servers the app was trying to talk to, looked up the cert from the server and which CA I needed. It was very arduous, especially when you installed a new app and just wanted to use it, e.g. for parking. This made me stop doing this. When giving talks to junior devs I used to explain that security and convenience are almost always on opposite sites and you need to figure out where between the two extremes you want to sit. In this case I opted for convenience.
Arduous much?
Sounds like a job for a machine.
Oh stop. You’ll never get this corner of the internet to admit such things.
Careful! They’re gonna whoop our asses:
Shouldnt you also disable the “Comodo” ones?
Pray tell 🤔
Holy crap, that is some valuable insight! Thanks! :D
I remember thay Lets Encrypt fiasco. Certainly made it hard to figure out the right LE cert when installing onto client websites.
Thanks for reminding me to do that!
No problem! But as I told another person, I’m only doing this because I’m not updating my phone anymore, because One UI 8 and above have disabled unlocking of the bootloader. If you’re not rooted and you are still receiving updates from the vendor and Google, then I can’t imagine this being useful.
