On 2014-04-25 21:52:38 +0200, Alessandro Ghedini wrote: > On ven, apr 25, 2014 at 07:54:36 +0200, Vincent Lefevre wrote: > > most users don't know that curl doesn't have any > > check for certificate revocation by default. Before the Heartbleed > > bug, this could be regarded a not very important. But now there > > may have been much more leaks than before. So, curl should use an > > up-to-date Certificate Revocation List by default (which it supports) > > The problem with this kind of lists is that they need to be > frequently updated,
Yes, that's the current problem with Chromium. The current one distributed with Debian still doesn't have the certificates revoked after the Heartbleed bug. > so either 1) someone makes a package (like ca-certificates) that > provides a crl, and the data of such a package could be shared (like ca-certificates) by various user agents that use CRL's. Such a list is currently needed for Chromium. > or 2) curl dowloads such list from the internet every time it opens > an HTTPS connection. not every time. It doesn't really make sense to download a list again after a few seconds. There could be some "expire" setting of a downloaded list (IMHO, the order of magnitude would be the day). The user should also have the possibility to force a download (like he can force a reload of a cached page). > The "ca-crls" package would need someone to make it and keep it > updated daily to be of any use, and downloading random stuff from > internet for each connection doesn't sound too good either. Even if it's not daily and if downloading a CRL is not done for each connection, it could be quite good. And if done in combination with another method such as OSCP / OCSP stapling, it would be even better. > > or some other alternate method like Firefox. > > If you mean OCSP, most browsers don't even bother using that by > default, not in a way that would make the user safe anyway [1]. The > alternative (OCSP stapling) is probably not supported by enough > servers to be useful (but I may be wrong). Well, at least Iceweasel (which uses something based on OCSP) works on the example I've given. -- Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon) -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
