Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
1–10 of 329 posts
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#2This is huge, Symantec owns about 15% of the SSL certificate market[1], and as stated in the article, has issued 30% of in-use certificates. No certificate authority of this size has ever been raked over the coals like this.
[1] https://w3techs.com/technologies/history_overview/ssl_certif...
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#3This is huge, Symantec owns about 15% of the SSL certificate market[1], and as stated in the article, has issued 30% of in-use certificates. No certificate authority of this size has ever been raked over the coals like this. [1] https://w3techs.com/technologies/history_overview/ssl_certif...
Pretty much it will decide the question on whether or not the certificate system is even workable. My thesis is that either Symantec will not be able to respond (and so lose their ability to be a root certificate) in which case it will warn other root cert authorities to shape up or lose their business, or they will placate the Google and Chromium teams somehow and show that root cert authorities can be brought to bear.
Or they will ignore Google, continue to create bad certs, and users will start getting instructed by sites that they have to manually add a root certificate in order to use they site, and the entire ecosystem will collapse.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#4This is huge, Symantec owns about 15% of the SSL certificate market[1], and as stated in the article, has issued 30% of in-use certificates. No certificate authority of this size has ever been raked over the coals like this. [1] https://w3techs.com/technologies/history_overview/ssl_certif...
How is this different from StartCom except for size? Is the "too big to fail" enough of an argument here?
Edit: Oh wait. Verisign and Thawte. Okay, that's some massive excrement on a collision course with the ventilation device.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#5I'd be very surprised if Symantec doesn't have some backroom deal with intelligence agencies, and not just in the U.S. either, especially since they've acquired BlueCoat - a "security company" known for selling surveillance tools to authoritarian regimes - and after they made the BlueCoat CEO the CEO of Symantec.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#6This is huge, Symantec owns about 15% of the SSL certificate market[1], and as stated in the article, has issued 30% of in-use certificates. No certificate authority of this size has ever been raked over the coals like this. [1] https://w3techs.com/technologies/history_overview/ssl_certif...
Pretty much it will decide the question on whether or not the certificate system is even workable. My thesis is that either Symantec will not be able to respond (and so lose their ability to be a root certificate) in which case it will warn other root cert authorities to shape up or lose their business, or they will placate the Google and Chromium teams somehow and show that root cert authorities can be brought to be…
I think it's likelier that Symantec will start a negative PR campaign, leading its users to yell at google to change things, perhaps calling this FUD. Whether that'll be effective is another question.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#7> Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
When I read that something like this popped up in my head:
"Google is using the nuclear option on Symantec. Neat!"
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#8I'd be very surprised if Symantec doesn't have some backroom deal with intelligence agencies, and not just in the U.S. either, especially since they've acquired BlueCoat - a "security company" known for selling surveillance tools to authoritarian regimes - and after they made the BlueCoat CEO the CEO of Symantec.
Prior to the Symantec aquisition, VeriSign used to pitch just this thing as a product. AFAIK the usage was limited to DoD and a few mundane things.
The IC wasn't interested because it was easier for them to just steal certificates or work around TLS completely.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#9This is huge, Symantec owns about 15% of the SSL certificate market[1], and as stated in the article, has issued 30% of in-use certificates. No certificate authority of this size has ever been raked over the coals like this. [1] https://w3techs.com/technologies/history_overview/ssl_certif...
Pretty much it will decide the question on whether or not the certificate system is even workable. My thesis is that either Symantec will not be able to respond (and so lose their ability to be a root certificate) in which case it will warn other root cert authorities to shape up or lose their business, or they will placate the Google and Chromium teams somehow and show that root cert authorities can be brought to be…
Remember google has chrome AND android. I think they're big enough to win this battle if it comes down to that. Symantec is at the clear disadvantage.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#10> Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates When I read that something like this popped up in my head: "Google is using the nuclear option on Symantec. Neat!"
Perhaps it's neat for you, I just found out that our newly issued EV certificate status is being revoked in the next build of Chrome, so our expensive EV certificates may as well be $5 StartSSL certificates.
I imagine that there will be a lot of angry customers asking for refunds from Symantec/Verisign for certificates already issued which no longer conform to the offered product.