Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's Plan to Distrust Symantec Certificates

security.googleblog.com

Post reply on HN
Print view View original

91–100 of 207 posts

Re: Chrome's Plan to Distrust Symantec Certificates

#91

Post by tony101 »

rocqua wrote: post #66
driverdan wrote: post #59

Earlier quoted context omitted.

> I'm a company that needs to show the company name next to the padlock Does anyone actually look at or care about that?

See here [1] for a pretty good write-up arguing EV isn't worth much. One issue is that it only has value if you would notice it is missing. Would you trust a paypal site that just had the green padlock, but not the name? Do you think your parents would? [1] https://www.troyhunt.com/journey-to-an-extended-validation-c...

We need an 'Expect-EV' header, just like 'Expect-CT'. Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV is more expensive and onerous but it has the potential to thwart phishing.

Re: Chrome's Plan to Distrust Symantec Certificates

#92

Post by valarauca1 »

grandalf wrote: post #74

I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse. The incentive for a mass-market browser is to trust pretty much everything, but I'd prefer to use a browser that is a bit more paranoid. If a website can't load properly because I don't trust one or more of the CAs, I mi…

This is a managed by your OS.

You are free to delete CA's from its trust store.

What Chrome is doing is irreguarless if that cert is in your OS's store it won't trust it.

Keychain for OSX

mmc in windows cmd prompt

Linux has /usr/share/certificates

Re: Chrome's Plan to Distrust Symantec Certificates

#93

Post by Twirrim »

driverdan wrote: post #59
antihero wrote: post #52

What are some trustable providers of EV certificates? LetsEncrypt is wonderful, but if I'm a company that needs to show the company name next to the padlock, who should I be using? What's an easy way to check if a provider (for instance Gandi, who I use for my domains) is going to be culled by this? In fact, I don't even seem to able to find certificate information in Chrome any more - clicking on the padlock just gi…

> I'm a company that needs to show the company name next to the padlock Does anyone actually look at or care about that?

>Does anyone actually look at or care about that?

No. You'll note that Amazon doesn't. They spent a bunch of time trying to figure out if it made a difference for customers. It turns out it doesn't, so they don't bother with the extra expense.

Re: Chrome's Plan to Distrust Symantec Certificates

#94

Post by geofft »

grandalf wrote: post #74

I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse. The incentive for a mass-market browser is to trust pretty much everything, but I'd prefer to use a browser that is a bit more paranoid. If a website can't load properly because I don't trust one or more of the CAs, I mi…

> I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse.

But you do; the trusted entity is your browser manufacturer. Given the massive amount of attack surface in the browser, I'm already trusting my browser to make sound security decisions all the time. And I've seen really good work from both the Firefox and Chrome teams on asking hard questions towards CAs; I don't think I can think of a group I'd trust to make better decisions. (Arguably there's the EFF, but I definitely trust the EFF less as a technical body than Mozilla or Google, for the simple reason that the EFF is an advocacy body, not a technical body.)

> The incentive for a mass-market browser ... If I were a state actor intelligence agency

But protecting against intelligence agencies is most effective and important in a mass-market browser, not in a nerd browser. There isn't any sense in a society where nerds as a group have more protection against government dragnet surveillance than everyone else.

If you're a specific nerd working to save the world in a specific way and you're worried about targeted attacks against you personally, you have a threat model that can't be adequately responded to by trusting a subset of CAs. You need to do your important work on a machine that's locked down far more deeply than just by distrusting a few CAs (e.g., you probably want to disable 80% of the web platform to reduce attack surface), and ideally you'd do your less-sensitive work, e.g., reading the news and chatting with friends and listening to music, on a browser that looks as normal as possible to avoid standing out.

Re: Chrome's Plan to Distrust Symantec Certificates

#95

Post by rallison »

gscott wrote: post #79

Comodo is giving away free Certificates to Symantec customers https://www.comodo.com/Google-Chrome-announces-proposal-to-d...

For those considering Comodo, I'd ask that you reconsider.

They tried to trademark LetsEncrypt:

https://news.ycombinator.com/item?id=11964583

https://news.ycombinator.com/item?id=11973232

Bad OCR led to certificates being issued to the wrong people:

https://news.ycombinator.com/item?id=12761248

They created their own Superfish-like adware:

https://news.ycombinator.com/item?id=9091917

Re: Chrome's Plan to Distrust Symantec Certificates

#96

Post by kccqzy »

> This plan, arrived at after significant debate on the blink-dev forum, would allow reasonable time for a transition to new, independently-operated Managed Partner Infrastructure while Symantec modernizes and redesigns its infrastructure to adhere to industry standards.

It's funny they still mention giving Symantec an opportunity to modernize and redesign its infrastructure when Symantec simply decides to give up: http://investor.symantec.com/About/Investors/press-releases/...

Interestingly, this investor.symantec.com doesn't properly support HTTPS at all (certificate host name mismatch). I guess that speaks volume about how much Symantec itself cares about SSL/TLS and PKI.

Re: Chrome's Plan to Distrust Symantec Certificates

#97

Post by feelin_googley »

grandalf wrote: post #74

I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse. The incentive for a mass-market browser is to trust pretty much everything, but I'd prefer to use a browser that is a bit more paranoid. If a website can't load properly because I don't trust one or more of the CAs, I mi…

1. Uninstall the CA certficates the browser has pre-installed

2. Create and install own CA certificate

3. Download or create desired server certficates, sign them with own CA and install them

I have not tried 1 but I regularly do 2 and 3. (Usually for monitoring outgoing encrypted traffic.)

Anyway, the idea of your comment is spot on, I think. The process whereby users blindly trust browser authors has serious flaws.

The user should be the one controlling the list of trusted CAs and servers, not a third party such as ad-supported company or organization distributing a web browser.

The more the user (cf. third parties) actively controls what endpoints she will trust, the better.

The system should encourage users to be active in managing what certficates they will trust versus passively letting ad-supported web companies do this for them.

It is the user who has the greatest incentive to make things right in terms of her own security and privacy. Third parties may help, but they ultimately have their own interests to worry about.

Re: Chrome's Plan to Distrust Symantec Certificates

#99

Post by omni »

feelin_googley wrote: post #97
grandalf wrote: post #74

I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse. The incentive for a mass-market browser is to trust pretty much everything, but I'd prefer to use a browser that is a bit more paranoid. If a website can't load properly because I don't trust one or more of the CAs, I mi…

1. Uninstall the CA certficates the browser has pre-installed 2. Create and install own CA certificate 3. Download or create desired server certficates, sign them with own CA and install them I have not tried 1 but I regularly do 2 and 3. (Usually for monitoring outgoing encrypted traffic.) Anyway, the idea of your comment is spot on, I think. The process whereby users blindly trust browser authors has serious flaws.…

How do you know you're not being MitM'd during step 3?

Re: Chrome's Plan to Distrust Symantec Certificates

#100

Post by JoelJacobson »

SWIFT is the only single entity trusted by all banks in the world. I think they would be a perfect fit for a CA to issue online banking certificates, since there is no way to get around trusting SWIFT as a bank, so they might as well trust them for their certificates as well, instead of trusting Symantec or any other CA.

The less entities you have to trust, the better.

Post reply on HN