This is affecting Australia's Suncorp internet banking too. We reported the certificate error to them yesterday, and I've just updated that with a link to this article.
Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
51–60 of 95 posts
Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
#52Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…
» When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system. I'm not a Chrome user. But that sounds awful at first. What is the idea behind this service? Is there any documentation about the 'features' these flags can enable/disable? I understand that I'm paranoid at times AND I really dislike Google, but why would you…
For one:
https://chromium.googlesource.com/chromium/src.git/+/master/...
Also look for base::FieldTrialList in Chromium source. In this case, it seems to be: https://chromium.googlesource.com/chromium/src/net/+/master/...
Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
#53Earlier quoted context omitted.
You can use SAN certificates to avoid wildcards while still validating for a number of domains. They don't even need to be subdomains.
There's a limit to how many SAN's you can fit in one cert. There is apparently no defined upper bound, but dependent on the client's implementation. 25 - 100 names seems to be the common limit supported by most registrars. In the parent poster's case, it sounds like a good use case for a wildcard cert. They may have thousands of affiliates, and may not know all of the affiliates ahead of time, so with a SAN cert, wou…
Oh, I completely agree—I maintain a SAN and it's a royal pain in the ass.
But there are options, and a SAN has lower risk if your key is leaked (only the enumerated domains will validate).
Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
#54Earlier quoted context omitted.
» When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system. I'm not a Chrome user. But that sounds awful at first. What is the idea behind this service? Is there any documentation about the 'features' these flags can enable/disable? I understand that I'm paranoid at times AND I really dislike Google, but why would you…
If you "really" dislike Google, then why are you using Chrome?
> I'm not a Chrome user.
Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
#55Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…
Update: Finch is always disabled in Chromium builds. Disabling it was not a decision by distro maintainers.
Supposedly, the following command line options will enable it, but it seems like just upgrading is a better option:
--variations-server-url=https://clients4.google.com/chrome-variations/seed --fake-variations-channel=stable
Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
#56I'm using Chromium on Ubuntu 16, and I've been trying to visit https://www.nist.gov/ but I don't even get an option to 'browse insecurely' under the 'Advanced' link. In my experience that past couple days, I get the warning on about 10-25% of major web sites.
try typing 'badidea' on that page and report back if it works. :)
I love how discoverable GUIs are.
Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
#57Earlier quoted context omitted.
» When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system. I'm not a Chrome user. But that sounds awful at first. What is the idea behind this service? Is there any documentation about the 'features' these flags can enable/disable? I understand that I'm paranoid at times AND I really dislike Google, but why would you…
If you "really" dislike Google, then why are you using Chrome?
I'm not the GP, and even though I personally really dislike Google too, I'm forced to use Chrome because Firefox fucking sucks.
Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
#58This bit me on both the NYT and WSJ websites this past week using Chrome 53; CDNs they were using both broke with this error. Upgrading to Chrome 54 seemed to solved the problem for me (I'm using arch linux, fwiw).
me too, i saw it on amazon broken. i updated my chromium and all good.
Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
#59Earlier quoted context omitted.
» When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system. I'm not a Chrome user. But that sounds awful at first. What is the idea behind this service? Is there any documentation about the 'features' these flags can enable/disable? I understand that I'm paranoid at times AND I really dislike Google, but why would you…
I fail to see this as any more harmful than the auto updating feature. I understand the concern of multiple avenues to phone home as being worse than one, but it's negligible considering it's the same company. Coupled with all of their other services for security incidents, prediction, auto correct, spelling, usage stats, dangerous page warnings, etc, I think it's just another log on the fire and not worth being conc…
It actually is almost nothing like the auto updating feature.
Finch is mainly used for A/B testing. It doesn't push actual updates, all it does it turn existing features (flags) on and off. It's used for quickly A/B testing or incremental rolling new features and is designed to be more agile.
Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate
#60Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…
» When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system. I'm not a Chrome user. But that sounds awful at first. What is the idea behind this service? Is there any documentation about the 'features' these flags can enable/disable? I understand that I'm paranoid at times AND I really dislike Google, but why would you…
Update actually changes the binary/code of chrome. It pushes new features and content to you.
Finch only turns certain features on/off. It's used for A/B testing and incremental rollouts.
You can see a list of flags in chrome://flags
Mostly experimental stuff that will become full features soon, but until then they are behind a flag.
The two systems fulfill very different roles.