The difficulty of making sure your website is broken

(letsencrypt.org)

40 points | by mcpherrinm 3 hours ago

5 comments

  • nottorp 55 minutes ago
    In the same direction, I once wanted to test an embedded device on crap wifi.

    So I just ordered the cheapest AP I could find.

    Except the damn device worked perfectly. Slow but rock solid.

    One of our testers at $CURRENT_JOB also has trouble simulating a crap network, because our network is good.

    • gnopgnip 2 minutes ago
      You can simulate bad wifi with the throttling option on the network tab of your browser's developer tools
      • Groxx 40 minutes ago
        Some proxies, iptables extensions, and OS-provided tools exist - there's almost certainly a combo that would work for them. What platform?

        Unless it's for a custom physical device, then uh. idk. Probably something, proxying through another computer that is hosting a separate wifi network? But likely a lot harder.

        • nottorp 35 minutes ago
          I think he figured it out eventually, used some software tool. But I heard the complaining first.
      • paulirish 3 hours ago
        https://badssl.com/ also offers several test subdomains in the same vein.
        • ipython 2 hours ago
          Interesting. Chrome (146, macOS) shows no error messages on the revoked cert pages, but Firefox does (also macOS).
          • mcpherrinm 2 hours ago
            Yeah, Chrome only partly supports revocation (Not sure exactly the criteria, but our test sites don't match it).
            • moralestapia 1 hour ago
              Same with Brave, so it is a Chromium thing.
            • lifis 2 hours ago
              Vanadium, Chrome and Firefox (all for Android) all accept all the revoked certificates... But revoked.badssl.com is considered revoked
              • RunningDroid 1 hour ago
                > Vanadium, Chrome and Firefox (all for Android) all accept all the revoked certificates... But revoked.badssl.com is considered revoked

                Firefox Beta (150.0b7) is accepting all of the revoked certs on my device

              • bullen 3 hours ago
                Meanwhile HTTP keeps working just fine and is decentralized.

                Just "add your own crypto" on top, which is the ONLY thing a sane person would do.

                3... 2... 1... banned?

                • horsawlarway 1 hour ago
                  to actually tackle this (on the off chance you're serious, I'm assuming not) - this doesn't work.

                  The payload that implements your crypto cannot be delivered over http, because any intermediate party can just modify your implementation and trivially compromise it.

                  If you don't trust TLS, you have to pre-share something. In the case of TLS and modern browser security, the "pre-shared" part is the crypto implementation running in the browser, and the default trusted store of root CAs (which lives in the browser or OS, depending).

                  If you want to avoid trusting that, you've got to distribute your algorithm through an alternative channel you do trust.

                  • bullen 8 minutes ago
                    You are right presharing is a requirement, unless you hash the keys used to encrypt the secret into the secret itself, but that can only be prooven later on a channel where the same MITM is not present.

                    Work in progress, that said presharing solves enough for the world to dump DNS and HTTPS in a bin and light it on fire now because nobody has the power to implement all the MITM needed if everyone "makes their own crypto"!

                    Circular arguments and all...

                  • xandrius 2 hours ago
                    Did you self-ban?
                    • bullen 2 hours ago
                      XD Nope, more like self destruct! ;)