Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

groups.google.com

Post reply on HN
Print view View original

31–40 of 329 posts

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#31

Post by ceejayoz »

zorpner wrote: post #22
hannob wrote: post #15

Earlier quoted context omitted.

I for one find it totally neat that people realize their expensive EV cert was a waste of money. Although that was true before, too. EV certs are a waste of money, the only thing they do is show a green bar. They don't improve security.

As the neighbor comment points out, EV validation is absolutely not a waste of money. I've been part of A/B testing on most aspects of domain security and it's arguably one of the best ROIs out there for e-commerce sites. They don't improve security -- that is true.

> I've been part of A/B testing on most aspects of domain security and it's arguably one of the best ROIs out there for e-commerce sites.

That's a bit hard to reconcile with the fact that Amazon.com can't be bothered to get one.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#32

Post by gcp »

aianus wrote: post #23
hannob wrote: post #15

Earlier quoted context omitted.

I for one find it totally neat that people realize their expensive EV cert was a waste of money. Although that was true before, too. EV certs are a waste of money, the only thing they do is show a green bar. They don't improve security.

They can improve security. We used to pin the EV roots of a couple CAs that we trusted in our mobile apps and in the browser via hpkp. This protected against someone tricking or coercing a lesser CA into issuing a DV cert and MITMing us.

I don't understand how EV vs DV factors into certificate pinning here.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#33

Post by DaiPlusPlus »

zeveb wrote: post #27
ChuckMcM wrote: post #3

Earlier quoted context omitted.

Pretty much it will decide the question on whether or not the certificate system is even workable. My thesis is that either Symantec will not be able to respond (and so lose their ability to be a root certificate) in which case it will warn other root cert authorities to shape up or lose their business, or they will placate the Google and Chromium teams somehow and show that root cert authorities can be brought to be…

> Or they will ignore Google, continue to create bad certs, and users will start getting instructed by sites that they have to manually add a root certificate in order to use they site, and the entire ecosystem will collapse. IIRC that's Amazon's answer to 'how should a user install Amazon Prime on Android?' I don't know how successful they've been convincing users to allow installation of untrusted apps (I certainly…

Installing apps from other stores on Android is literally a checkbox away - but installing new root certs on computers is considerably harder, or impossible if your computer is locked-down (group policy, etc).

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#34

Post by prdonahue »

zie wrote: post #25

What is the chrome release schedule? i.e. what is the timeline for the 59 - 64 releases to happen? A quick google isn't getting me an answer(and I don't use Chrome, so don't really pay attention).

What'd you search for? I typed in: chrome release schedule

and this was the first link: https://www.chromium.org/developers/calendar.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#35

Post by nailer »

Shanea93 wrote: post #28
nailer wrote: post #26

Earlier quoted context omitted.

EV certificates have the same level of confidentiality and integrity as DV certs, but they have different authentication - specifically, they tie the certificate to a legal entity rather than a domain name. ie. https://paypal.com-customerservice.ru vs PayPal Inc [US] | https://paypal.com I run https://certsimple.com . We sell EV certs. But you can verify the above pretty easily by checking out the EV guidelines, the…

Your pricing is very reasonable and I've just placed your website at the top of my to-do list tomorrow morning, thanks for posting.

Thanks! We're actually about the middle of the road price wise, our main thing is tech: the EV process can be pretty painful, our role is to speed it it up and make it easier. We start checking against government directories in 63 countries prior to payment, use webcrypto in supported browsers to quickly generate CSRs, make instant-paste openssl / windows scripts to make an ECC or RSA keypair quickly if you prefer to make keys on your own servers, we have a LOT of country specific logic, a meta directory of 'Qualified Independent Information Sources' to handle that part of the EV requirements, we validate in realtime and a bunch of other stuff to save you time and effort - https://certsimple.com/about.

There's cheaper options around, but we only do EV and we're the best at it.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#36

Post by theptip »

aianus wrote: post #23
hannob wrote: post #15

Earlier quoted context omitted.

I for one find it totally neat that people realize their expensive EV cert was a waste of money. Although that was true before, too. EV certs are a waste of money, the only thing they do is show a green bar. They don't improve security.

They can improve security. We used to pin the EV roots of a couple CAs that we trusted in our mobile apps and in the browser via hpkp. This protected against someone tricking or coercing a lesser CA into issuing a DV cert and MITMing us.

Why does EV make a difference here? Can't you pin an intermediate or root cert from your CA of choice and avoid other CAs issuing end certs for your domain just as well?

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#38

Post by jasode »

makmanalp wrote: post #6
ChuckMcM wrote: post #3

Earlier quoted context omitted.

Pretty much it will decide the question on whether or not the certificate system is even workable. My thesis is that either Symantec will not be able to respond (and so lose their ability to be a root certificate) in which case it will warn other root cert authorities to shape up or lose their business, or they will placate the Google and Chromium teams somehow and show that root cert authorities can be brought to be…

I think it's likelier that Symantec will start a negative PR campaign, leading its users to yell at google to change things, perhaps calling this FUD. Whether that'll be effective is another question.

>Symantec will start a negative PR campaign, leading its users to yell at google to change things,

It seems Google has the leverage, not Symantec.

A PR awareness campaign is out-of-band information that's separate from the web surfer actually navigating to a site. Millions of users would see a scary message similar to "This site's security certificate is not trusted!"[1].

To prevent scary security popups, which is more likely?

1) The website owners abandon Symantec and switch to a Certificate Authority not flagged by Chrome

or

2) Users get "educated" on Symantec's side of the story and manually add Symantec as a trusted root certificate. (Some can switch browsers but for many non-techies, that's a pain because they have all their bookmarks in Chrome -- and migrating them on mobile phone is not obvious.)

[1] https://www.google.com/search?q=google+chrome+this+site%27s+...

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#39

Post by jlgaddis »

DaiPlusPlus wrote: post #30
stevecalifornia wrote: post #16

TLDR: Google has lost trust in Symantec's ability to properly validate certificates they issue. Chrome has a Root Certificate Policy that expects a CA to perform in a manner commensurate with the trust being placed in them and the Google team appears to see evidence that they are not living up to the standard laid out. They propose a gradual distrust of existing certificates by reducing the 'maximum age' of the certi…

They're also planning on stripping EV status from their Certs too... that's going to be fun for a lot of banks.

"effective immediately"

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#40

Post by the8472 »

musicnarcoman wrote: post #7

> Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates When I read that something like this popped up in my head: "Google is using the nuclear option on Symantec. Neat!"

If they're going nuclear then it's akin to merely lobbing tactical nukes on military bases, not city-busters on some megalopolis.

They're "only" planning to remove the extended validation indicator and reduce the maximum validity time instead of completely phasing out the root.

Post reply on HN