Mac users: enable certificate revocation checking

http://securityskeptic.typepad.com/the-security-skeptic/2011/04/mac-users-listen-up-enable-certificate-checking.html

by gmac • 15 years ago

52 12 15 years ago

securityskeptic.typepad.com

agl• 15 years ago

Setting OCSP checking to best attempt doesn't really solve anything because, if you're assuming that an attacker is MITMing your HTTPS connection, it's not too much more to assume that they can intercept your OCSP checks too.

http://www.imperialviolet.org/2011/03/18/revocation.html

On the other hand, setting strict checking means that large parts of the web become unusable when a major OCSP server goes down and that would immediately make them juicy DDoS targets.

bdhe• 15 years ago

> Attacks in Tunisia and only open WiFi networks are the sort of attacks which can defeat revocation.

Could you give more details about this statement from your essay?

newman314• 15 years ago

IIRC, another drawback of enabling this is that you reveal your browser history. On mobile device right now so not easy to find article to cite but should be avail via a quick search

blinkingled4• 15 years ago

And of course after enabling this for Safari the Mac App Store starts to hang on startup in Certificate check code path. :(

I recently enabled "Logout after idle for [ ] min" setting to be more secure on OSX and LoginWindow just hangs if I leave the laptop idle and let it go to sleep.

Looks like Apple only tests for default and common settings.

gmac• 15 years ago

Hmm, that's poor. https://bugreport.apple.com/? (Or can I only access this because I'm a registered developer?)

blinkingled4• 15 years ago

I have been filing bugs at that URL since some time but they invariably go nowhere - no updates for years, bugs aren't fixed most times. So kind of kills my incentive. And no, anyone can report bugs using that URL - no need to be a registered developer, at least not yet.

Entlin2• 15 years ago

I enabled it as well. App store doesn't hang, but is much slower: downloading an app normally starts after 1 second, with the fix enabled it takes 8s to even start.

LoginWindow sleep worked fine when logging off and pressing the sleep button. Didn't have time to properly test your case.

The big question for me is: How do people with iPhone and iPads enable this? The test in the article yields "not trusted" instead of revoked...

Funny that Apple has revoking turned on for App certs, but not for SSL. Guess they value their platform higher than user data...

blinkingled4• 15 years ago

About the LoginWindow - I have password protected screen saver enabled as well. Perhaps that's what you are missing.

For me after I wake it up from sleep after 60 minutes (the setting for idle logout), it wakes up to a beach ball and I can't enter my password.

thatinternetor• 15 years ago

What's your hardware setup? OS version?

blinkingled4• 15 years ago

MacBook Pro 17" 2010 model, 8G RAM, 10.6.7 all updates applied. [ Also screensaver is enabled along with asking for password ]

mattparcher• 15 years ago

The recommended settings[0] in Keychain Access.app appear to be the defaults in the Lion (10.7) Developer Preview 2.

[0] Preferences > Certificates:

  Online Certificate Status Protocol (OCSP): Best Attempt
  Certificate Revocation List (CRL): Best Attempt
  Priority: OCSP

Mac users: enable certificate revocation checking

Related Stories