Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Symantec CA Response to Google Proposal and Community Feedback

symantec.com

Post reply on HN
Print view View original

101–110 of 129 posts

Re: Symantec CA Response to Google Proposal and Community Feedback

#101

Post by mjevans »

mdip wrote: post #62
mjevans wrote: post #10

Earlier quoted context omitted.

You're better off moving your accounts to a local credit union that does security correctly.

Have local credit unions gotten better at this? I left a local credit union a decade ago because they didn't offer online banking at all and when they finally did, the security practices they used were horrible . Memory may not serve perfectly here but I recall they had no EV cert (while common with banks, not everyone had them back then), the login form was provided in-the-clear POSTing to HTTPS and many of the bank…

It depends upon the CU in question. There are typically /many/ local (to a state/region) credit unions, so you get multiple shots at this. SECOND, the reason you're better off is that you are literally part owner of that 'union' as a member. They inherently (typically) give you better rates and treat you better.

Re: Symantec CA Response to Google Proposal and Community Feedback

#102

Post by hdhzy »

kbar13 wrote: post #91
eykanal wrote: post #38

Earlier quoted context omitted.

This comment irritates me. 1) The point of the first part of their post is not "we're too big", it's "a move like this would disrupt the lives of an awful lot of people." Even more so, consider what would happen if Google were to update Chrome to not accept these certs. For internal applications, the IT departments of all these companies—which likely total a few hundreds of thousands of users in total—would simply ma…

would simply refusing to recognize NEW symantec certificates issued after a certain date in the near future be a sufficient compromise? it won't affect institutions that have pre-existing certificates, which will eventually expire by themselves.

It's not that simple as they can backdate the cert, like StartSSL/WoSign:

> It turns out WoSign has repeatedly been lying to Mozilla about backdating SHA-1 SSL Certificates

Source: https://www.riskiq.com/blog/labs/wosign-and-startcom-caught-...

Certs could be checked via Certificate Transparency but currently this is not required for DV certs.

Re: Symantec CA Response to Google Proposal and Community Feedback

#103

Post by bitmapbrother »

tyingq wrote: post #74
bitmapbrother wrote: post #57

Earlier quoted context omitted.

I'm constantly amazed by how some people think Google has this magical ability to update an OS that was built by another OEM. That's like asking Debian to update Ubuntu.

They set the terms for licensing Android, and have used leverage for other things they want or don't want. Edit: Yes, really. https://arstechnica.com/gadgets/2014/02/new-android-oem-lice...

So let's say they put in a rule that said all OEM's must update their devices every month or lose access to Google Play apps and services. What happens when the carriers start delaying or preventing the patches and updates from flowing to the devices? Does Google uphold the rule and revoke their access? Or do they start extending the time by 1 month? Or how about 2 months? Or what about 6 months? What's the point of adding a rule you can't enforce?

Re: Symantec CA Response to Google Proposal and Community Feedback

#104

Post by MichaelGG »

eykanal wrote: post #38
MichaelGG wrote: post #4

>require these applications to be recoded, recompiled and redistributed. Aka "updated". The entire post is basically "ok how about we be really good from now on and suffer no consequences, cause it'd be really shitty for us if we had to be penalised". They also posture a lot talking about how big their customers are, almost boasting about how inflexible and slow these big companies are, as if that's somehow Google's…

This comment irritates me. 1) The point of the first part of their post is not "we're too big", it's "a move like this would disrupt the lives of an awful lot of people." Even more so, consider what would happen if Google were to update Chrome to not accept these certs. For internal applications, the IT departments of all these companies—which likely total a few hundreds of thousands of users in total—would simply ma…

Again, how is this anyone else's problem? It'd be rewarding bad behaviour and poor technical solutions. These companies will find a way to workaround it.

A suitable compromise could be an override switch that can only be activated via Group Policy. That'd at least be a reasonable suggestion from Symantec. Not their current offer of nothing.

As far as "updating" my point was that they described a routine mobile app update as "recoding" as if it'd be lots of actual code to rewrite. And again, the fact a large company has no way to easily update in face of a security problem really is their problem, not ours.

Re: Symantec CA Response to Google Proposal and Community Feedback

#105

Post by borplk »

clhodapp wrote: post #40
MichaelGG wrote: post #4

>require these applications to be recoded, recompiled and redistributed. Aka "updated". The entire post is basically "ok how about we be really good from now on and suffer no consequences, cause it'd be really shitty for us if we had to be penalised". They also posture a lot talking about how big their customers are, almost boasting about how inflexible and slow these big companies are, as if that's somehow Google's…

For some reason, technical professionals associated with large organizations seem to actively enjoy pretending that basic upkeep is beyond the means of their organization (or has a poor value proposition). I suspect that it comes from a perverse enjoyment of being "pragmatic" in the face of "idealism" but really they're just saying "My org refuses to pay the costs associated with correctly operating the technologies…

Spot on. A variation of this happens about browsers as well.

How hard is it to run some version of Chrome or Firefox that is within the last 5 major releases?

I don't care how big your organisation is, it's not that hard.

Yet they want to off-load the costs to the rest of the world to keep sites compatible with their IE8.

Re: Symantec CA Response to Google Proposal and Community Feedback

#106

Post by MichaelGG »

bitmapbrother wrote: post #103
tyingq wrote: post #74

Earlier quoted context omitted.

They set the terms for licensing Android, and have used leverage for other things they want or don't want. Edit: Yes, really. https://arstechnica.com/gadgets/2014/02/new-android-oem-lice...

So let's say they put in a rule that said all OEM's must update their devices every month or lose access to Google Play apps and services. What happens when the carriers start delaying or preventing the patches and updates from flowing to the devices? Does Google uphold the rule and revoke their access? Or do they start extending the time by 1 month? Or how about 2 months? Or what about 6 months? What's the point of…

Easy, just apply the block to new devices -- the only thing the OEMs care about. They can easily write the contract to that effect.

Re: Symantec CA Response to Google Proposal and Community Feedback

#108

Post by ploxiln »

X-Cubed wrote: post #72
ploxiln wrote: post #53

Earlier quoted context omitted.

Imagine the embedded device or mobile app connects to a https://api.example.com/.. . and so does their web app. They need to use a new certificate for api.example.com, signed by a different CA root, because when Chrome tries to run the web app it won't trust the old certificate, nor a new cert signed by the old root. So they get a new cert signed by a different root so Chrome works, but then the embedded or mobile ap…

An easier way around this sort of issue is to change their web app to use a different domain, and only put the new certificate from a different CA on that domain. It's not necessary to update every device. Embedded devices => https://api.example.com (Symantec cert) Browsers => https://new-api.example.com (New trusted cert) Another approach is that if the devices are old enough they're probably using a deprecated vers…

True, but you know how it is ... the management of these companies would prefer to do nothing if it is possible. They'll put most of their efforts into that strategy.

Re: Symantec CA Response to Google Proposal and Community Feedback

#109

Post by bitmapbrother »

MichaelGG wrote: post #106
bitmapbrother wrote: post #103

Earlier quoted context omitted.

So let's say they put in a rule that said all OEM's must update their devices every month or lose access to Google Play apps and services. What happens when the carriers start delaying or preventing the patches and updates from flowing to the devices? Does Google uphold the rule and revoke their access? Or do they start extending the time by 1 month? Or how about 2 months? Or what about 6 months? What's the point of…

Easy, just apply the block to new devices -- the only thing the OEMs care about. They can easily write the contract to that effect.

In the case of the carrier preventing the transmission of patches or OS upgrades you would be punishing the OEM for a problem created by the carrier and out of the control of the OEM. Tangentially, If I was a carrier I would use this to my advantage when negotiating. If you thought carriers were bad now, just wait until they have the power to withhold Google Play services and apps to an OEM's future phones.
Post reply on HN