• oldfart@lemm.ee
      link
      fedilink
      English
      arrow-up
      0
      ·
      6 days ago

      Yeah, now imagine pinning certs that change weekly.

      My first thought is that old school secure software (like claws-mail) treats a cert change as a minor security incident, asking you to confirm every time. Completely different school of thought.

      • jagged_circle@feddit.nl
        link
        fedilink
        English
        arrow-up
        0
        ·
        edit-2
        6 days ago

        You can pin to your own CA. Then it doesn’t matter if you want to update your certs frequently.

        • semi [he/him]@lemmy.ml
          link
          fedilink
          English
          arrow-up
          0
          ·
          6 days ago

          I’m a developer and would appreciate you going into more specifics about which certificates you suggest pinning.

          • jagged_circle@feddit.nl
            link
            fedilink
            English
            arrow-up
            0
            ·
            edit-2
            6 days ago

            I’m saying that if you’re a developer of software that communicates between two nodes across the internet, you shouldn’t rely on X.509 because the common root stores have historically been filled with compromised CAs, which would let someone with that CA decrypt and view the messages you send with TLS.

            You should mint your own certs and pin their fingerprints so that your application will only send messages if the fingerprint of the cert on the other end matches your trusted cert.

              • jagged_circle@feddit.nl
                link
                fedilink
                English
                arrow-up
                0
                ·
                6 days ago

                Yeah, fuck the users. We can just slap “100% secure” on the box and who cares if some woman is raped and murdered because we decided not to follow best security practices, right? /s