Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

sslmate.com

Post reply on HN
Print view View original

71–80 of 95 posts

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#71

Post by nailer »

walrus01 wrote: post #68
xyzzy123 wrote: post #25

Earlier quoted context omitted.

extended validation (mandatory for bigcos) and support contracts (important for corporates, not sure how useful "in real life"). Also, inventory management, which is helpful when you have hundreds or thousands of certs.

There are lots of EV issuers who haven't been caught doing shady shit like Symantec...

cough Hey there!

CertSimple only does EV, and we do it completely differently from every other company: we check as much of your company's details before you pay, matching your order to a registered/active entity, flagging up things before asking for your credit card number, and helping you resolve any missing identification steps based on your company, order and the domain names involved.

I've been on HN for a decade and was at YC in Mountain View last week for the 10-min final interview last week (we didn't make it, which I blame on me being a jetlagged mess). OTOH the AirBnB we stayed in used a customer as their ISP.

We're used by a bunch of companies HN folks might know, including Travis, Tito, and Monzo.

https://certsimple.com/about

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#72

Post by wfunction »

Ph0X wrote: post #59
kodablah wrote: post #50

Earlier quoted context omitted.

I fail to see this as any more harmful than the auto updating feature. I understand the concern of multiple avenues to phone home as being worse than one, but it's negligible considering it's the same company. Coupled with all of their other services for security incidents, prediction, auto correct, spelling, usage stats, dangerous page warnings, etc, I think it's just another log on the fire and not worth being conc…

It actually is almost nothing like the auto updating feature. Finch is mainly used for A/B testing. It doesn't push actual updates, all it does it turn existing features (flags) on and off. It's used for quickly A/B testing or incremental rolling new features and is designed to be more agile.

That means it uniquely identified you to Google every day then, right?

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#74

Post by phreack »

wfunction wrote: post #72
Ph0X wrote: post #59

Earlier quoted context omitted.

It actually is almost nothing like the auto updating feature. Finch is mainly used for A/B testing. It doesn't push actual updates, all it does it turn existing features (flags) on and off. It's used for quickly A/B testing or incremental rolling new features and is designed to be more agile.

That means it uniquely identified you to Google every day then, right?

Always assume so with Google products.

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#76

Post by aaronmdjones »

paulddraper wrote: post #69
snug wrote: post #61

Earlier quoted context omitted.

To be RFC compliant, it MUST NOT allow the user to ignore the errors. 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")) should be done with "no user recourse". This means that the user should not be presented with a dialog giving her the option to proceed. Rather, it should be treated similarly to a server error wher…

Well I suppose curl/wget will never be RFC compliant user agents (curl -k, wget --no-check-certificate). But somehow I think they'll still be used...

wget writes a ~/.wget-hsts file with the HSTS information for any URI you have accessed that served an HSTS header.

Making it ignore --no-check-certificate if the file has an entry for the hostname you are visiting should be trivial, if it hasn't been done already.

Re: Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

#79

Post by gcb0 »

darklajid wrote: post #48
agwa wrote: post #22

Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's history of incompetence. Some website operators, such as Chase, asked Symantec to submit their certificates to Certificate Transparency logs in such a way that the certificate wouldn't be trust…

» When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system. I'm not a Chrome user. But that sounds awful at first. What is the idea behind this service? Is there any documentation about the 'features' these flags can enable/disable? I understand that I'm paranoid at times AND I really dislike Google, but why would you…

because Google don't know bugs on your (their) browser affecting their revenue.

interesting, if you're a victim of mitm attacks, i wonder if attackers can abuse that to disable some certificate check features to make spoofing ssl sites easier.

Post reply on HN