Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

groups.google.com

Post reply on HN
Print view View original

201–210 of 329 posts

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#201

Post by debatem1 »

Sir_Substance wrote: post #68
ygjb wrote: post #50

Earlier quoted context omitted.

ha.ha.ha. I worked at a financial institution for several years. There are many, many IT folks, internal auditors, and others who are probably wishing they wore their brown pants to work today. SSL certificates are cheap in contrast to the labour intensive management practices that exist around them, especially around legacy platforms that may have been hardcoded to use certificates from a specific issuer (not that I…

>especially around legacy platforms that may have been hardcoded to use certificates from a specific issuer (not that I have ever seen that before, no one would be that foolish right? :/) D'ya know, I would have naively assumed this wasn't technically possible. I shudder not only to think of the code, but also of the thought process that could compel someone to undergo the effort of bricking themselves into this corn…

It's pretty common in the embedded world where you don't have enough flash space-- or don't want to use what flash you have-- to hold a root CA store.

Such devices are usually great targets for learning how not to secure things, because when they care that little they often don't get anything else right either.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#202

Post by agwa »

Tepix wrote: post #127
looklittlejohn wrote: post #65

Earlier quoted context omitted.

Well, Comodo's had an okay track-record, if I recall correctly. But I also don't recall them being cheap.

Haven't they been hacked more than once?

One of Comodo's registration authorities was breached, but not Comodo themselves. Comodo were able to detect the breach and cut off the compromised RA because they were monitoring what their RAs were doing. Symantec, on the other hand, didn't know that their RAs were mis-validating certificates until I noticed and told them.

(Registration authorities are third parties that perform certificate validation on behalf of the CA. I think Comodo bears some responsibility for delegating validation to an RA that was compromised, but Symantec's conduct has been so much worse in comparison.)

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#203

Post by newman314 »

sandGorgon wrote: post #59
Ajedi32 wrote: post #52

Earlier quoted context omitted.

> No we cannot use LetsEncrypt for convenience reasons (we bake our certificate pub key in many places) Why does that matter? Pretty sure you don't have to change your public key to get or renew a Let's Encrypt cert.

we spawn our servers and scale them up and down. We terminate ssl internally to our applications which are on Docker. Letsencrypt is painful on docker. I dont mind paying 40$ per year for a wildcard ssl certificate.

xenolf/lego in DNS mode FTW.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#204

Post by geofft »

sandGorgon wrote: post #59
Ajedi32 wrote: post #52

Earlier quoted context omitted.

> No we cannot use LetsEncrypt for convenience reasons (we bake our certificate pub key in many places) Why does that matter? Pretty sure you don't have to change your public key to get or renew a Let's Encrypt cert.

we spawn our servers and scale them up and down. We terminate ssl internally to our applications which are on Docker. Letsencrypt is painful on docker. I dont mind paying 40$ per year for a wildcard ssl certificate.

You can get a Let's Encrypt certificate manually; you don't have to automate it. There are a few options, including https://gethttpsforfree.com/ by 'diafygi, which involves running some openssl commands and pasting public keys and signatures into the web form (which in turn send API requests to Let's Encrypt). Or you can find or build a client yourself.

The only hard part is you'll have to find a way to prove ownership other than email ownership. But if these are public-facing web servers, implementing a response for the HTTP challenge shouldn't be hard, and as the website points out, you can configure all your servers to send an HTTP redirect for the challenge to some other single URL, which you can configure manually. https://letsencrypt.org/docs/integration-guide/#picking-a-ch...

This process is significantly less painful, especially on renewals, than the traditional certificate renewal process. If you're already planning on spending an hour of someone's time a year to request a renewal, pay for it, click a link in an email, etc., plan on spending 10 minute of someone's time every two months, instead. (And an hour is optimistic based on my experience.)

Your public and private keys don't change, since these are renewals. You're just updating the certificates themselves. And certificates are public data (they're sent in their entirety when you make an HTTPS connection), so you can just put them in a git repo or an S3 bucket or whatever else is convenient for your deploy process.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#205

Post by Piskvorrr »

voidlogic wrote: post #196

Unless Mozilla and IE goe along with this, effected orgs could just inform users that Chrome is not a supported browser? Have we heard from the other browser vendors?

"We now do not support the one browser that has over 50% of usershare." To me, that seems to be the equivalent of shooting yourself in the foot...using the Tsar Bomba.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#206

Post by ivanr »

tptacek wrote: post #129
stevecalifornia wrote: post #16

TLDR: Google has lost trust in Symantec's ability to properly validate certificates they issue. Chrome has a Root Certificate Policy that expects a CA to perform in a manner commensurate with the trust being placed in them and the Google team appears to see evidence that they are not living up to the standard laid out. They propose a gradual distrust of existing certificates by reducing the 'maximum age' of the certi…

This is a good summary, but I'd clarify it by saying that Google isn't being subjective about Symantec's process failures. The CA industry self-regulates. Its regulatory organization is the CA/B Forum, and their principal regulation is the Baseline Requirements (the BRs). Google claims Symantec violated multiple BRs. If you want to dig a little deeper, here's the last version of the BRs: https://cabforum.org/wp-conte…

Small correction: the CA industry doesn't self-regulate. Both browsers and CAs participate in the CA/Browser Forum and my (admittedly outsider) impression is that browsers almost always have the upper hand.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#207

Post by dochtman »

Animats wrote: post #64

What's Mozilla doing?

I was wondering the same thing. In previous cases, it seemed that Mozilla and Google acted as one, by working off the same NSS trust database. Has something about that changed? Apparently Google thinks Mozilla is moving to slow on this one?

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#208

Post by johncolanduoni »

beachy wrote: post #187
TenOhms wrote: post #157

It amazes me how often Symantec is in the news about the same subject, yet they seem to be incapable of learning a lesson from it.

As they say "It is difficult to get a man to understand something, when his salary depends upon his not understanding it."

I don't think that's the case here, I think Symantec understood perfectly but thought they were too big to get anything more than a slap on the wrist from Chrome. Chrome's previous sanctions on Symantec, though very helpful for those trying to evaluate Symantec and inconvenient to implement on Symantec's side, were not much of a threat to their business.

Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates

#210

Post by Shanea93 »

CountSessine wrote: post #194
tedunangst wrote: post #186

Earlier quoted context omitted.

Maybe after their HSTS header expires. What do they do until then? Or for all the users with https bookmarks?

Well, just looking at the Bank of America example, they don't seem to use HSTS in their landing page. How widespread is HSTS? How long is the expiry period typically set for (I would guess a long time?) Does anyone still use browser bookmarks? Actually, just thinking about it, it might be even simpler than this. If Bank of America wanted to, couldn't they still host their redirect landing page over SSL with a valid n…

HSTS is currently used by 2.8% of all websites, up from 1.2% this time last year. [1] If people are using Qualys SSL Labs tool to check their "grade", they won't be awarded an A+ grade unless their HSTS max-age is at least 6 months [2], so I'm going to assume the average is somewhere close to that due to how common usage of that tool is.

My grandma still uses browser bookmarks, but I have no none-anecdotal source for this.

BoA could absolutely do all the things you just mentioned, but all of them are more difficult than simply replacing their certificate using Comodo or some other trusted root CA.

[1] https://w3techs.com/technologies/details/ce-hsts/all/all

[2] https://community.qualys.com/thread/15972

Post reply on HN