Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

groups.google.com

Post reply on HN
Print view View original

131–140 of 329 posts

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#131

Post by yuhong »

galdosdi wrote: post #116
praptak wrote: post #55

It's a bit scary how much power do browser creators wield. Even if it's being used for good.

It's better than it used to be. We have 4 major browser vendors now, Apple (Safari and iOS), Microsoft, Google (Chrome and Android), and Mozilla, all of which have plenty of market share and none of which have most of it. There was a long period of many years when IE was king and anything else was irrelevant. There was also, even earlier than that, a period where Mosaic/Netscape/Mozilla and its kin were dominant. Thi…

Indeed, there was a set of roots IE 5.01/NT4 SP6/Win2000 and later trusted, and at that time only XP did automatic root cert update making them very valuable. Just before then, I think IE/SChannel only trusted VeriSign/Thawte/CyberTrust, and VeriSign bought Thawte just after IE 5.01 and NT4 SP6 was released.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#132

Post by gcp »

tajen wrote: post #123
NateyJay wrote: post #2

This is huge, Symantec owns about 15% of the SSL certificate market[1], and as stated in the article, has issued 30% of in-use certificates. No certificate authority of this size has ever been raked over the coals like this. [1] https://w3techs.com/technologies/history_overview/ssl_certif...

Am I the only one worried about LetsEncrypt becoming a monopoly? This move from Google is, indirectly, a huge service for them.

I don't see the link with LetsEncrypt here. Symantec doesn't give away free certs, and LetsEncrypt doesn't do EV.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#133

Post by inglor »

jf wrote: post #121
andrewfong wrote: post #113

Earlier quoted context omitted.

> Or I could subscribe to feeds from other entities I trust, like the EFF. How would you validate that the EFF's feed is actually from the EFF? Assuming we're using existing SSL infrastructure, the browser would first need to trust the CA used by the EFF, which means we need an initial set of trusted CAs.

> which means we need an initial set of trusted CAs. How would you validate that the initial set of trusted CA roots is actually from those CAs?

It ships with your operating system, which you physically obtain from another computer (with hardware like a USB drive or via internal network).

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#134

Post by phonon »

unabridged wrote: post #109

SYMC is at an all time high, and every one of their EV certificate customers is about to start talking to different security vendors. The Jan18, Jan19 near ATM puts are quite reasonably priced.

Crazy! A third of SYMC's revenue might be going POOF! and the market is just shrugging?

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#135

Post by pauldino »

DaiPlusPlus wrote: post #88
Sir_Substance wrote: post #68

Earlier quoted context omitted.

>especially around legacy platforms that may have been hardcoded to use certificates from a specific issuer (not that I have ever seen that before, no one would be that foolish right? :/) D'ya know, I would have naively assumed this wasn't technically possible. I shudder not only to think of the code, but also of the thought process that could compel someone to undergo the effort of bricking themselves into this corn…

It happened to me - I was working on an application for the pre-paid electricty system in Texas: the server-side code connects to a data-source over a TLS connection (complete with client-side certificates too), except the server-side used a self-signed certificate, and my code didn't have admin/root rights on the client hardware so it had to use in-app certification verification code. I had to hard-code the root CA'…

So basically you're pinning the server certificate chain into your signed client code? Actually that sounds like a good thing!

https://www.owasp.org/index.php/Certificate_and_Public_Key_P...

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#136

Post by dangrossman »

tajen wrote: post #123
NateyJay wrote: post #2

This is huge, Symantec owns about 15% of the SSL certificate market[1], and as stated in the article, has issued 30% of in-use certificates. No certificate authority of this size has ever been raked over the coals like this. [1] https://w3techs.com/technologies/history_overview/ssl_certif...

Am I the only one worried about LetsEncrypt becoming a monopoly? This move from Google is, indirectly, a huge service for them.

If I'm reading the settings page right, Chrome trusts over 70 certificate issuers right now. Let's Encrypt is just one of those, and only issues a limited set of certificate types.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#137

Post by stouset »

tlrobinson wrote: post #76

I've often wondered: why is trust in CAs an all-or-nothing proposition (aside from EV certs), and why should my particular browser vendor have all the authority over who I should trust? For the vast majority of users that's probably just fine, but I would have thought that there'd be a browser or extension or something that allows security-conscious power users more fine-grained control over this by now. For example,…

Because then you have the web of trust model, which absolutely sucks in practice for people to actually use.

So yes, you could do this. But outside of a few hundred people, nobody wants to actually undergo the constant effort this would actually require.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#138

Post by gcp »

ourcat wrote: post #92
pfg wrote: post #42

Earlier quoted context omitted.

That's unlikely, as they currently do not offer certificates to the general public. I imagine if they do at some point, it might be as part of something like their version of Amazon's ACM for their Cloud offerings, or for custom domains on sites like Blogger. I'd expect both to be free. They're also a platinum sponsor of Let's Encrypt.

This happened recently with all my free StartSSL / Startcom certificates. I switched to LetsEncrypt. Also noticing Google and Mozilla's sponsorship.

Google and Mozilla were heavy sponsors of LetsEncrypt (in money and in Mozilla's case manpower too) because they wanted to push out HTTPS more, and mandate HTTPS for some new HTML features. That would have been problematic if certificates weren't free or convenient.

In Mozilla's case, HTTPS is better for privacy. In Google's case, HTTPS makes it harder to substitude their ads.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#139

Post by jwarren »

revelation wrote: post #73
shkkmo wrote: post #48

Is there a list anywhere of which EV cert providers use Symantec as a CA?

From the Google link on Symantec root certs: http://pastebin.com/raw/nUEq5cFP Not sure if all of them issue EV.

I extracted a readable list of cert providers:

  Equifax
  VeriSign
  TC TrustCenter GmbH
  RSA Data Security
  Equifax Secure
  Symantec Corporation
  GeoTrust Inc.
  Thawte Consulting cc
  thawte
  Thawte Consulting
  Equifax Secure Inc.
  TC TrustCenter for Security in Data Networks GmbH
  The USERTRUST Network
  Thawte
Source here in case I screwed up or anyone wants to verify my terrible regex: https://gist.github.com/JodiWarren/376aebbf7ce6902b06766843f...

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#140

Post by jldugger »

tlrobinson wrote: post #76

I've often wondered: why is trust in CAs an all-or-nothing proposition (aside from EV certs), and why should my particular browser vendor have all the authority over who I should trust? For the vast majority of users that's probably just fine, but I would have thought that there'd be a browser or extension or something that allows security-conscious power users more fine-grained control over this by now. For example,…

> I've often wondered: why is trust in CAs an all-or-nothing proposition (aside from EV certs), and why should my particular browser vendor have all the authority over who I should trust?

It doesn't. You can adjust your root certs in Firefox by going to about:preferences#advanced and clicking on certificates.

But what does partial trust look like? Showing half of the HTML? An eyebrow raised emoji instead of a lock?

Post reply on HN