Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

groups.google.com

Post reply on HN
Print view View original

111–120 of 329 posts

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#111

Post by jaas »

marina8888 wrote: post #95

But why is https://w3techs.com/technologies/history_overview/ssl_certif... saying Let’s Encrypt has 0.1% when https://letsencrypt.org/stats/ says 32 million Fully-Qualified Domains Active? 32 million = 0.1% 32 000 million SSL certs? = 100% ? what?

TLDR: Look at the IdenTrust numbers if you want to know the real Let's Encrypt numbers.

Not many people use Let's Encrypt's own root for their validation chain when they use Let's Encrypt certificates. The Let's Encrypt root is not propagated widely enough across clients.

We (Let's Encrypt) have a cross-signature from IdenTrust, that's what most people use because it's widely trusted. IdenTrust issuance is otherwise very small, so you can effectively consider the IdenTrust numbers in charts like this to be a proxy for Let's Encrypt.

-Josh from Let's Encrypt

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#112

Post by pilom »

agwa wrote: post #99
Ajedi32 wrote: post #91

Anyone have any more information on the incidents that triggered this response? I was able to find this article on Google's Security Blog: https://security.googleblog.com/2015/10/sustaining-digital-c... But that's almost 2 years old. Have there been any more recent incidents that I'm unaware of?

https://www.mail-archive.com/dev-security-policy@lists.mozil...

TL;DR: in 2016 Symantec issued unauthorized certs for example.com (owned by ICANN) and a multi-domain cert with SANs for test1.com, test2.com, test3.com... even though those domains are each owned by very different organizations and did not all agree to have a common cert.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#113

Post by andrewfong »

tlrobinson wrote: post #76

I've often wondered: why is trust in CAs an all-or-nothing proposition (aside from EV certs), and why should my particular browser vendor have all the authority over who I should trust? For the vast majority of users that's probably just fine, but I would have thought that there'd be a browser or extension or something that allows security-conscious power users more fine-grained control over this by now. For example,…

> Or I could subscribe to feeds from other entities I trust, like the EFF.

How would you validate that the EFF's feed is actually from the EFF? Assuming we're using existing SSL infrastructure, the browser would first need to trust the CA used by the EFF, which means we need an initial set of trusted CAs.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#114

Post by jasode »

gcp wrote: post #105
jasode wrote: post #80

Earlier quoted context omitted.

>Large websites using Symantec certs start telling users Chrome is "broken" I'm having a hard time thinking of a scenario where a large website concludes it's cheaper to convince web shoppers at ecommerce sites and web visitors at news sites to switch to Firefox/IE instead of the website just switching CA vendors. If you're a website that wants to put up zero friction between buyers submitting their credit-card info…

This line of reasoning works for banks or commercial entities. But note, it does not work for governments. They can, and will, put up a red banner instructing the user to install another browser (or in case of Firefox 52, explain how to disable updates so you can keep using NPAPI plugins).

Interesting point. I spot checked CAs for some of the most popular USA government websites.

irs.gov (Internal Revenue Service): Entrust CA

va.gov (Veterans Affairs) : Symantec CA

So if Symantec is the CA for a critical mass of government websites that won't abandon them, Google Chrome could lose this battle.

Without looking at traffic data (e.g Alexa), my intuition says the vast majority of web traffic is not government websites. If Veterans Affairs forces user to switch browsers, I'm guessing people would still use their Chrome browser for all the other websites because that's where all their bookmarks live.

As for non-government websites, I notice that Netflix.com currently has a Symantec Class 3 CA. I'm guessing Netflix would rather switch to another CA.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#115

Post by ballenf »

jwildeboer wrote: post #103

TL;DR Google prefers to override what the standards say about validity of certicates instead of what would be the logical thing: stop trusting Symantec root Certs. A dangerous precedent.

Can you elaborate? Having trouble parsing whether you think Google is over- or under-reacting.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#116

Post by galdosdi »

praptak wrote: post #55

It's a bit scary how much power do browser creators wield. Even if it's being used for good.

It's better than it used to be. We have 4 major browser vendors now, Apple (Safari and iOS), Microsoft, Google (Chrome and Android), and Mozilla, all of which have plenty of market share and none of which have most of it.

There was a long period of many years when IE was king and anything else was irrelevant. There was also, even earlier than that, a period where Mosaic/Netscape/Mozilla and its kin were dominant.

This is the best it's been in a long time in terms of no single browser maker controlling the market.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#117

Post by soperj »

sandGorgon wrote: post #49

> All Symantec issued certificates. GeoTrust and Thawte are CAs operated by Symantec, simply afforded different branding. >While this list may need to be updated for some recently created roots, https://chromium.googlesource.com/chromium/src/+/master/net/... may accurately capture the state of impact Damn. There goes my certificate (Rapidssl). Anybody know what are the remaining, trustworthy certificate issuers ? No…

Also wondering this, as I'm about to buy a new cert.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#118

Post by the8472 »

Sir_Substance wrote: post #68
ygjb wrote: post #50

Earlier quoted context omitted.

ha.ha.ha. I worked at a financial institution for several years. There are many, many IT folks, internal auditors, and others who are probably wishing they wore their brown pants to work today. SSL certificates are cheap in contrast to the labour intensive management practices that exist around them, especially around legacy platforms that may have been hardcoded to use certificates from a specific issuer (not that I…

>especially around legacy platforms that may have been hardcoded to use certificates from a specific issuer (not that I have ever seen that before, no one would be that foolish right? :/) D'ya know, I would have naively assumed this wasn't technically possible. I shudder not only to think of the code, but also of the thought process that could compel someone to undergo the effort of bricking themselves into this corn…

Hardcoding certificates is actually way too easy. SSL libraries don't necessarily use the system ca store or even know about it. OpenSSL has the option of disabling certifcate validation, providing your own certificate list or pointing to some system-supplied certificates which you need to find first. So in a way you even have to count yourself lucky if the hardcoded one instead of choosing to just disabling validation.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#119

Post by tajen »

jasode wrote: post #38
makmanalp wrote: post #6

Earlier quoted context omitted.

I think it's likelier that Symantec will start a negative PR campaign, leading its users to yell at google to change things, perhaps calling this FUD. Whether that'll be effective is another question.

>Symantec will start a negative PR campaign, leading its users to yell at google to change things, It seems Google has the leverage, not Symantec. A PR awareness campaign is out-of-band information that's separate from the web surfer actually navigating to a site. Millions of users would see a scary message similar to "This site's security certificate is not trusted!" [1]. To prevent scary security popups, which is m…

or

4) Banks require Chrome 55, "here's a download", good thing it's open-source, and we get the IE6 story again.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#120

Post by kbenson »

makmanalp wrote: post #6
ChuckMcM wrote: post #3

Earlier quoted context omitted.

Pretty much it will decide the question on whether or not the certificate system is even workable. My thesis is that either Symantec will not be able to respond (and so lose their ability to be a root certificate) in which case it will warn other root cert authorities to shape up or lose their business, or they will placate the Google and Chromium teams somehow and show that root cert authorities can be brought to be…

I think it's likelier that Symantec will start a negative PR campaign, leading its users to yell at google to change things, perhaps calling this FUD. Whether that'll be effective is another question.

To which the response will inevitably be "Communication with the bank can't be trusted" and many people will read as "The bank can't be trusted". I think people will quickly come to the conclusion that the stakes are much higher for them if the bank can't be trusted when they have their money there, compared to the browser being too assertive, and will just move their money. Without definitive knowledge or a good understanding of all the intricacies, that's the safe decision.

Banks know this. Like the CA system, the whole banking system only functions because of trust, and in the US that trust is backed by the government. They aren't going to let that erode. Regardless of whether all their back-end certs get updated, their customer facing ones will if needed.

Post reply on HN