Hacker News new | ask | show | jobs
by tptacek 924 days ago
Once again: this is silly, because whatever conversation we are having about the standard, your ability to decrypt old messages would not have been impacted. Standard revisions don't turn the previous standard into secret forbidden knowledge.

What's really being asked for here is the capability to seamlessly continue sending messages with the previous, weak constructions, into the indefinite future, and have the installed base of the system continue seamlessly reading them. I think that is in fact a goal of PGP, and one of its great weaknesses.
1 comments
kazinator 924 days ago
When standards remove the requirements for something after a period of obsolescence, that tends to send a message to the implementors to remove that from the software.

Users who still rely on that have to use the old software, against which there can be barriers:

- old executables don't run on newer OS (particularly in the Unix world).

- old source code won't build.

- old code won't retrieve the old data from the newer server it has been migrated do.

Things like that.

The barriers could be significant that even someone skilled and motivated such as myself would be discouraged.

link
Avamander 924 days ago
> Users who still rely on that have to use the old software, against which there can be barriers

Not all reliance is reasonable though.

Some legacy software can only do SSLv3 or lower, does that mean the rest of the internet has to carry that support around? Abso-f-lutely not.

The same applies here. If you really need that ancient stuff that loses support, repackage them in newer encryption or remove the obsolete layer. It's highly probable that information no longer needs to stay encrypted at rest anyways.

link
kazinator 924 days ago
In my opinion, the Internet should not be removing support for older SSL. The highest SSL version that is common to server and client should always be used.
link
woodruffw 924 days ago
> The highest SSL version that is common to server and client should always be used.

That is how it works. What you're missing is that everyone, both servers and clients, agrees that supporting old SSL versions is a bad idea. And they're right.

link
kazinator 924 days ago
Since I don't agree, it cannot be everyone.

More precisely, I don't agree with web clients not connecting to old servers.

link
dale_glass 923 days ago
Security done properly requires some sacrifices. Keeping old insecure versions working means exposing users to trivial ways of breaking encryption.
link