Live data from Hacker News

Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

sslmate.com

61–70 of 95 posts

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#61

Earlier quoted context omitted.

Using HSTS on a website will generally prevent your browser from allowing you to continue, which is fair: the website owner has explicitly indicated the website should only ever be used over a encrypted connection, and that is not the case..

I understand who owns the website. Who owns my browser?

To be RFC compliant, it MUST NOT allow the user to ignore the errors.

   12.1.  No User Recourse

   Failing secure connection establishment on any warnings or errors
   (per Section 8.4 ("Errors in Secure Transport Establishment")) should
   be done with "no user recourse".  This means that the user should not
   be presented with a dialog giving her the option to proceed.  Rather,
   it should be treated similarly to a server error where there is
   nothing further the user can do with respect to interacting with the
   target web application, other than wait and retry.

   Essentially, "any warnings or errors" means anything that would cause
   the UA implementation to announce to the user that something is not
   entirely correct with the connection establishment.

   Not doing this, i.e., allowing user recourse such as "clicking
   through warning/error dialogs", is a recipe for a man-in-the-middle
   attack.  If a web application issues an HSTS Policy, then it is
   implicitly opting into the "no user recourse" approach, whereby all
   certificate errors or warnings cause a connection termination, with
   no chance to "fool" users into making the wrong decision and
   compromising themselves.
https://tools.ietf.org/html/rfc6797#section-12.1

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#62

Earlier quoted context omitted.

Using HSTS on a website will generally prevent your browser from allowing you to continue, which is fair: the website owner has explicitly indicated the website should only ever be used over a encrypted connection, and that is not the case..

I understand who owns the website. Who owns my browser?

You can configure most major browsers to forget HSTS entries they already know about, so to the question of who owns your browser wrt honoring HSTS, I'd say it's the user.

http://classically.me/blogs/how-clear-hsts-settings-major-br...

Though now I'm curious if Chrome can be configured to forget HSTS for Google sites.

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#65

Earlier quoted context omitted.

I understand who owns the website. Who owns my browser?

You can configure most major browsers to forget HSTS entries they already know about, so to the question of who owns your browser wrt honoring HSTS, I'd say it's the user. http://classically.me/blogs/how-clear-hsts-settings-major-br... Though now I'm curious if Chrome can be configured to forget HSTS for Google sites.

I'm not 100% certain, but is that to just delete the HSTS Header that is saved into the browser?

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#67
post #5

I'm using Chromium on Ubuntu 16, and I've been trying to visit https://www.nist.gov/ but I don't even get an option to 'browse insecurely' under the 'Advanced' link. In my experience that past couple days, I get the warning on about 10-25% of major web sites.

try typing 'badidea' on that page and report back if it works. :)

Very nice :) Thanks.

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#68
post #24

Earlier quoted context omitted.

Is there any reason, in 2016, to use Symantec over LetsEncrypt?

extended validation (mandatory for bigcos) and support contracts (important for corporates, not sure how useful "in real life"). Also, inventory management, which is helpful when you have hundreds or thousands of certs.

There are lots of EV issuers who haven't been caught doing shady shit like Symantec...

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#69
post #61

Earlier quoted context omitted.

I understand who owns the website. Who owns my browser?

To be RFC compliant, it MUST NOT allow the user to ignore the errors. 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")) should be done with "no user recourse". This means that the user should not be presented with a dialog giving her the option to proceed. Rather, it should be treated similarly to a server error wher…

Well I suppose curl/wget will never be RFC compliant user agents (curl -k, wget --no-check-certificate).

But somehow I think they'll still be used...

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#70
post #61

Earlier quoted context omitted.

I understand who owns the website. Who owns my browser?

To be RFC compliant, it MUST NOT allow the user to ignore the errors. 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")) should be done with "no user recourse". This means that the user should not be presented with a dialog giving her the option to proceed. Rather, it should be treated similarly to a server error wher…

[deleted]
Post reply on HN