PKI is broken. The problem isn't the crypto, it's the wardens.
Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
241–250 of 329 posts
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#242Earlier quoted context omitted.
Have they published anywhere the violations? Normally browser makers publish openly evidence of mis-issued certificates, together with having the discussion with the vendor in the public. It's sad that this announcement from Google seems to basically be saying "we had a closed door dispute with Symantec, and now don't trust them".
The issue has gotten plenty of public discussion (from Google, Mozilla, and others) on Mozilla's dev-security-policy mailing list: https://groups.google.com/forum/?fromgroups=#!forum/mozilla....
The main thread is https://groups.google.com/forum/?fromgroups=#!topic/mozilla.... , and it contains some nuggets like this:
So after reading this, the following auditors aren't
trusted by Symantec anymore:
- E&Y Korea
- E&Y Brazil
The following isn't trusted by Mozilla anymore:
- E&Y Hong Kong
This seems to be a worrying trend to me.
KurtRe: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#243Earlier quoted context omitted.
Oh, I know. But name me a non-IT professional that knows the difference, or would care that their bank has "secure" and not "Bank of America LLC". I think there are groups of smart PKI/UI people discussing how better to design security warnings at various levels of EV/HTTPS/Partial HTTPS/HTTP.
A. EV certs are bought for a reason, the very "green bar". Customers will notice this and won't be happy about it. B. the 9 month expiration will also make customers unhappy Both measures will put operational pressure on Symantecs customers and eventually decrease Symantec's market share in the business.
> A. EV certs are bought for a reason, the very "green bar". Customers will notice this and won't be happy about it.
Are you sure? I've never heard/seen/notice anyone non-technical care remotely. Or even know what it means.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#244Earlier quoted context omitted.
or 3) Large websites using Symantec certs start telling users Chrome is "broken" and we find out if users will switch browsers, not care about the security, and/or complain to the sites. I definitely find any variation of #3 to be more likely than #2. I see it as a battle between #1 and #3.
>Large websites using Symantec certs start telling users Chrome is "broken" I'm having a hard time thinking of a scenario where a large website concludes it's cheaper to convince web shoppers at ecommerce sites and web visitors at news sites to switch to Firefox/IE instead of the website just switching CA vendors. If you're a website that wants to put up zero friction between buyers submitting their credit-card info…
Mozilla has also been putting the hard word on Symantec over this issue, I don't think they'll be too far behind Chromium in taking action.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#245Earlier quoted context omitted.
TL;DR: in 2016 Symantec issued unauthorized certs for example.com (owned by ICANN) and a multi-domain cert with SANs for test1.com, test2.com, test3.com... even though those domains are each owned by very different organizations and did not all agree to have a common cert.
It's more than that. The ensuing thread uncovered that Symantec had exercised very lacking oversight over their partners (called Registration Authorities, or RAs) who were allowed to perform certificate validation on Symantec's behalf.
...and at least one of those RAs didn't seem to be doing any validation at all!
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#246Earlier quoted context omitted.
I for one find it totally neat that people realize their expensive EV cert was a waste of money. Although that was true before, too. EV certs are a waste of money, the only thing they do is show a green bar. They don't improve security.
As the neighbor comment points out, EV validation is absolutely not a waste of money. I've been part of A/B testing on most aspects of domain security and it's arguably one of the best ROIs out there for e-commerce sites. They don't improve security -- that is true.
So you're serving an EV vs. DV/OV some random % of the time for same site and measuring conversions? Mind sharing the data?
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#247Earlier quoted context omitted.
A. EV certs are bought for a reason, the very "green bar". Customers will notice this and won't be happy about it. B. the 9 month expiration will also make customers unhappy Both measures will put operational pressure on Symantecs customers and eventually decrease Symantec's market share in the business.
> A. EV certs are bought for a reason, the very "green bar". Customers will notice this and won't be happy about it. Are you sure? I've never heard/seen/notice anyone non-technical care remotely. Or even know what it means.
We've been asked about it by "enterprise"-y clients.
It's on the checklist of things companies ask about when assessing third-party services.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#248Earlier quoted context omitted.
ha.ha.ha. I worked at a financial institution for several years. There are many, many IT folks, internal auditors, and others who are probably wishing they wore their brown pants to work today. SSL certificates are cheap in contrast to the labour intensive management practices that exist around them, especially around legacy platforms that may have been hardcoded to use certificates from a specific issuer (not that I…
>especially around legacy platforms that may have been hardcoded to use certificates from a specific issuer (not that I have ever seen that before, no one would be that foolish right? :/) D'ya know, I would have naively assumed this wasn't technically possible. I shudder not only to think of the code, but also of the thought process that could compel someone to undergo the effort of bricking themselves into this corn…
This is essentially what HTTP Public Key Pinning (HPKP) does [0]. HPKP is a header your web server responds with that tells the client's browser, "Only trust my domain if the certificate presented is in a chain that goes up through one of these CA public keys". This is so an attacker can't go buy a certificate from a less-diligent CA and use that to MITM HTTPS traffic between clients and your domain.
You pick two or more CAs you trust, and brick yourself into a corner saying "these are the only CAs you should ever trust w.r.t. this domain".
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#249Earlier quoted context omitted.
> A. EV certs are bought for a reason, the very "green bar". Customers will notice this and won't be happy about it. Are you sure? I've never heard/seen/notice anyone non-technical care remotely. Or even know what it means.
We've been asked about it by "enterprise"-y clients. It's on the checklist of things companies ask about when assessing third-party services.
Those are not users. Those are people who have read up about SSL certificates and have bought in to the hype.
Re: Intent to Deprecate and Remove: Trust in Existing Symantec-Issued Certificates
#250Earlier quoted context omitted.
I'm simply pointing out that both companies seem to think they can do what they want, due to having such large market share. Do we know that Symantec is being malicious, or just lazy like Google's response to spam?
This is a real security issue and spam isn't.
[deleted]