Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's Plan to Distrust Symantec Certificates

security.googleblog.com

Post reply on HN
Print view View original

71–80 of 207 posts

Re: Chrome's Plan to Distrust Symantec Certificates

#71

Post by cperciva »

dragonwriter wrote: post #30
cperciva wrote: post #20

Earlier quoted context omitted.

But "distrust" doesn't convey the full meaning. They're not talking about merely not trusting Symantec certificates; they're talking about removing existing trust in the certificates.

> But "distrust" doesn't convey the full meaning. They're not talking about merely not trusting Symantec certificates; they're talking about removing existing trust in the certificates. “distrust” alone only communicates not trusting, true. But the word isn't alone, it is in the phrase “plan to distrust”, which communicates that the not-trusting is a change from the status quo that will occur in the future.

which communicates that the not-trusting is a change

Not necessarily. "Plan to distrust" would be consistent with "a company has announced that they're going to start issuing certificates; we won't trust them". You and I know that Symantec is a major CA which is currently trusted by Chrome, but that isn't implied by the headline.

Re: Chrome's Plan to Distrust Symantec Certificates

#72

Post by snuxoll »

rocqua wrote: post #66
driverdan wrote: post #59

Earlier quoted context omitted.

> I'm a company that needs to show the company name next to the padlock Does anyone actually look at or care about that?

See here [1] for a pretty good write-up arguing EV isn't worth much. One issue is that it only has value if you would notice it is missing. Would you trust a paypal site that just had the green padlock, but not the name? Do you think your parents would? [1] https://www.troyhunt.com/journey-to-an-extended-validation-c...

It's useful for no-name companies, an EV certificate highlights a company that went through unnecessary pain just to get a little green checkbox - I know I personally trust smaller online retailers more when they have one since they've had to prove their identity to a CA. Nobody notices the lack of EV on amazon.com, because, well, it's Amazon.

Re: Chrome's Plan to Distrust Symantec Certificates

#73

Post by gerdesj »

antihero wrote: post #52

What are some trustable providers of EV certificates? LetsEncrypt is wonderful, but if I'm a company that needs to show the company name next to the padlock, who should I be using? What's an easy way to check if a provider (for instance Gandi, who I use for my domains) is going to be culled by this? In fact, I don't even seem to able to find certificate information in Chrome any more - clicking on the padlock just gi…

You will need an Extended Validation (EV) certificate to get your name in the bar. To get it to go green you "only" need a Domain Validation (DV) certificate.

In simple terms: DV proves you own your DNS domain and EV proves that your real world entity owns the DNS domain.

Lets Encrypt will only do DV and quite right too. EV costs a far bit more because it should require some proper checks - for example checking Company's House in the UK for a Limited Company's details and matching them up against real people.

You can set a flag in Chrom{ium!e} that will put a link to the cert in the menu that drops down when you click on the green bit, saving you a trip to dev tools. Go to chrome://flags and search for "Show certificate link". Don't know why it isn't the default.

Re: Chrome's Plan to Distrust Symantec Certificates

#74

Post by grandalf »

I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse.

The incentive for a mass-market browser is to trust pretty much everything, but I'd prefer to use a browser that is a bit more paranoid.

If a website can't load properly because I don't trust one or more of the CAs, I might want to temporarily "live dangerously" but would be a bit more cautious about typing data into a form, etc.

Browser vendors should not try to create a one-size-fits-all list of trusted CAs, since there is obviously a very different level of trust deserved by various CAs based on the track record of each one.

If I were a state actor intelligence agency, compromising CAs would be toward the top of my list because of the amazing opportunity for man-in-the-middle attacks.

Distrusting Symantec certificates is a great step in the right direction.

Re: Chrome's Plan to Distrust Symantec Certificates

#75

Post by peterwwillis »

pfg wrote: post #62
peterwwillis wrote: post #57

Earlier quoted context omitted.

I wasn't aware of CAA, that's a nice development. > Do you want the ability to issue certificates under your own (constrained) intermediate certificate? Look at it this way: currently, if you can send network traffic from some IP space, you can create valid domain certs. This is the equivalent of using a hosts file with a list of IPs to authenticate an ssh connection. Yes, I think an intermediary key, and not simply…

I'm not sure I understand your suggestion. How does the intermediary key improve the domain validation process? There's an CAA extension in the works that will allow you to bind domains to ACME accounts (which are protected by your account key). Let's Encrypt has plans to support it. Is that what you're looking for?

An example:

  1. Webserver requests cert for xyz.com.
  1.1. Generates private key
  1.2. Generates csr
  1.2. Sends csr to ICA.

  2. ICA requests cert for xyz.com.
  2.1. ICA generates private key
  2.2. Signs Webserver's csr with private key
  2.3. Sends signed csr to CA

  3. CA issues certificate
  3.1. CA looks up CCA record for xyz.com
  3.1.1. CCA contains ICA's key fingerprint
  3.2. CA verifies signature of Webserver's csr with ICA's key fingerprint
  3.3. CA verifies Webserver controls domain xyz.com.
  3.4. CA issues cert
At no time could a bad actor simply compromise the webserver and issue a new cert for xyz.com, because it would need the ICA to approve it (and that could require user intervention). Thus, network access alone would not be enough to generate certs. Maybe this is the extension they're making?

Re: Chrome's Plan to Distrust Symantec Certificates

#76

Post by ori_b »

snuxoll wrote: post #72
rocqua wrote: post #66

Earlier quoted context omitted.

See here [1] for a pretty good write-up arguing EV isn't worth much. One issue is that it only has value if you would notice it is missing. Would you trust a paypal site that just had the green padlock, but not the name? Do you think your parents would? [1] https://www.troyhunt.com/journey-to-an-extended-validation-c...

It's useful for no-name companies, an EV certificate highlights a company that went through unnecessary pain just to get a little green checkbox - I know I personally trust smaller online retailers more when they have one since they've had to prove their identity to a CA. Nobody notices the lack of EV on amazon.com, because, well, it's Amazon.

> Nobody notices the lack of EV on amazon.com, because, well, it's Amazon.

Which means that nobody notices the lack of EV on amazoone.com, because, well, it'as Amazon.

Re: Chrome's Plan to Distrust Symantec Certificates

#77

Post by gerdesj »

_asummers wrote: post #12
dsp1234 wrote: post #3

"including Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL" RIP RapidSSL wildcard

LE Wildcards should be around by then! Hopefully enough tooling will exist to make that migration seamless, or as seamless as cert migration can be.

You'll be looking forwards to discovering how to do DNS dynamic updates.

LE wildcard certs will only be DNS validated and not using a web server (for obvious reasons, when you think about it)

Re: Chrome's Plan to Distrust Symantec Certificates

#78

Post by BillinghamJ »

antihero wrote: post #52

What are some trustable providers of EV certificates? LetsEncrypt is wonderful, but if I'm a company that needs to show the company name next to the padlock, who should I be using? What's an easy way to check if a provider (for instance Gandi, who I use for my domains) is going to be culled by this? In fact, I don't even seem to able to find certificate information in Chrome any more - clicking on the padlock just gi…

https://certsimple.com

It’s incredibly fast, the guy who runs it is nice, great customer service. It just does what you need.

Re: Chrome's Plan to Distrust Symantec Certificates

#80

Post by antihero »

gerdesj wrote: post #73
antihero wrote: post #52

What are some trustable providers of EV certificates? LetsEncrypt is wonderful, but if I'm a company that needs to show the company name next to the padlock, who should I be using? What's an easy way to check if a provider (for instance Gandi, who I use for my domains) is going to be culled by this? In fact, I don't even seem to able to find certificate information in Chrome any more - clicking on the padlock just gi…

You will need an Extended Validation (EV) certificate to get your name in the bar. To get it to go green you "only" need a Domain Validation (DV) certificate. In simple terms: DV proves you own your DNS domain and EV proves that your real world entity owns the DNS domain. Lets Encrypt will only do DV and quite right too. EV costs a far bit more because it should require some proper checks - for example checking Compa…

Yeah I figured that EV is out of scope for LetsEncrypt. Thanks for the tip about the flags!
Post reply on HN