Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's Plan to Distrust Symantec Certificates

security.googleblog.com

Post reply on HN
Print view View original

151–160 of 207 posts

Re: Chrome's Plan to Distrust Symantec Certificates

#151

Post by otp124 »

grandalf wrote: post #74

I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse. The incentive for a mass-market browser is to trust pretty much everything, but I'd prefer to use a browser that is a bit more paranoid. If a website can't load properly because I don't trust one or more of the CAs, I mi…

Would you accept a browser plugin that reads only the certificate information and makes a decision to alert, or block/override the DOM rendering to protect the user?

Re: Chrome's Plan to Distrust Symantec Certificates

#152

Post by JauntyHatAngle »

aseipp wrote: post #129
vacri wrote: post #116

Earlier quoted context omitted.

> The user should be the one controlling the list of trusted CAs and servers, not a third party such as ad-supported company or organization distributing a web browser. No, they really shouldn't. Security is a ridiculously complex arena, and the amount of knowledge you need to make an intelligent setup on this is considerable. For tech-heads, fine, but the vast majority of people are not tech-heads. If you switched o…

The funniest part of this ongoing debate I see -- to me, at least -- is that the end result is, effectively, one of two options. Given the way we as a society use technology, today: 1) Piss off the like, 10,000 technical nerds who care about this, by having sensible defaults. "We should really teach people to fully manage their CA chain! It sucks I have to spend 20 minutes doing this once a year after spending 10,000…

>The funniest part of this ongoing debate I see -- to me, at least -- is that the end result is, effectively, one of two options. Given the way we as a society use technology, today

Speaking more generally, rather than specifically about CA chains, I respectfully disagree with you there.

Imho, what usually happens in a sane world, is that we spend most of the time between these two extremes, in a pendulum as we balance one way, get burned, go back the other way, get burned again and repeat.

Im fine with it being that way until someone releases a true ground breaker and redefines what we are balancing.

>But honestly, my go-to strategy these days is mostly "whenever most technical people try to give security advice and speak on behalf of most users, almost always: do the exact opposite thing, in order to keep the users secure".

I think I understand what you are saying, but that comes across as you cherry picking the bits of a technical persons advice that a layman wouldn't understand. The "exact opposite" is sorta hard to define.

Re: Chrome's Plan to Distrust Symantec Certificates

#153

Post by sambe »

greenleafjacob wrote: post #135
wongarsu wrote: post #123

Earlier quoted context omitted.

For someone as big as Amazon, isn't it cheaper to just get an EV cert than spending significant time figuring out whether it's worth it?

Not if it increases conversation rate by X%.

That would only reinforce the point.

Re: Chrome's Plan to Distrust Symantec Certificates

#154

Post by mehrdadn »

_nedR wrote: post #149
dpacmittal wrote: post #141

Slightly offtopic but still related to web-security in general; how can I be sure about chrome extensions that I'm using are not doing malicious stuff? I think if a state actor or a resourceful entity wishes to steal data of users, attacking/hijacking/buying a popular chrome extension would be so much easier than attacking a CA or doing MITM over SSL, and trying to decrypt it. I've always hated the concept of certain…

Chrome has a good permissions model that i don't think can be much improved on. An ad-blocker needs access to data on every page you visit in order to do its job. I don't really see a way around it; Thats just how the web is constructed.. You can disable 3rd party scripts on your side (Firefox has Noscript addon for that; chrome should have something similar) but that may break the website you 're visiting Workaround…

> Chrome has a good permissions model that i don't think can be much improved on. An ad-blocker needs access to data on every page you visit in order to do its job. I don't really see a way around it

I don't imagine an ad blocker needs the ability to send data over the network.

I also don't expect it should need to alter cookies or local storage, though perhaps there's a random counterexample somewhere?

Most importantly of all, I think disable forced auto-update of extensions would help. It would make things a lot safer if users had control over when their extensions were updated. That way a malicious version could be taken down without having affected too many people.

Re: Chrome's Plan to Distrust Symantec Certificates

#155

Post by hannob »

grandalf wrote: post #74

I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse. The incentive for a mass-market browser is to trust pretty much everything, but I'd prefer to use a browser that is a bit more paranoid. If a website can't load properly because I don't trust one or more of the CAs, I mi…

> I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse.

This is an idea that I hear in variations from time to time, yet I think it's utterly wrong and goes against everything we know about IT security UI.

The reason why HTTPS works at scale and is - with all its weaknesses - a crypto success story is because it works automatically. Unlike other things like PGP that ultimately expect from the user to get an understanding of complex concepts like public key cryptography and web of trusts.

What you're trying to do is move HTTPS away from "it just works" to "user has to understand what a CA and a PKI is".

Fortunately none of the relevant actors or browser vendors is moving in that direction, the opposite is happening. HTTPS is becoming the default, it works automatically and the security improvements that are being deployed (mainly CT) are systemic improvements to strengthen the whole system.

Re: Chrome's Plan to Distrust Symantec Certificates

#156

Post by ykler »

hannob wrote: post #155
grandalf wrote: post #74

I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse. The incentive for a mass-market browser is to trust pretty much everything, but I'd prefer to use a browser that is a bit more paranoid. If a website can't load properly because I don't trust one or more of the CAs, I mi…

> I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse. This is an idea that I hear in variations from time to time, yet I think it's utterly wrong and goes against everything we know about IT security UI. The reason why HTTPS works at scale and is - with all its weaknesses…

I certainly agree that something that just works is by far the most important priority and do worry about anything that could muddy that message. On the other hand, I suppose what the parent proposes could be useful for users with heightened security concerns even if they are only a tiny minority, similarly to how tor is useful (and, in fact, using this setting would be less conspicuous than using tor and also less suspicious since there is no way of using it for criminal activity).

Re: Chrome's Plan to Distrust Symantec Certificates

#157

Post by dpacmittal »

_nedR wrote: post #149
dpacmittal wrote: post #141

Slightly offtopic but still related to web-security in general; how can I be sure about chrome extensions that I'm using are not doing malicious stuff? I think if a state actor or a resourceful entity wishes to steal data of users, attacking/hijacking/buying a popular chrome extension would be so much easier than attacking a CA or doing MITM over SSL, and trying to decrypt it. I've always hated the concept of certain…

Chrome has a good permissions model that i don't think can be much improved on. An ad-blocker needs access to data on every page you visit in order to do its job. I don't really see a way around it; Thats just how the web is constructed.. You can disable 3rd party scripts on your side (Firefox has Noscript addon for that; chrome should have something similar) but that may break the website you 're visiting Workaround…

Chrome doesn't allow extensions running on https://chrome.google.com/webstore/category/extensions, which means there's already provisions in code which disallows extensions to run on certain URLs. They could just add a setting where users can add to that list of pages.

Re: Chrome's Plan to Distrust Symantec Certificates

#158

Post by [deleted] »

dotancohen wrote: post #148
feelin_googley wrote: post #97

Earlier quoted context omitted.

1. Uninstall the CA certficates the browser has pre-installed 2. Create and install own CA certificate 3. Download or create desired server certficates, sign them with own CA and install them I have not tried 1 but I regularly do 2 and 3. (Usually for monitoring outgoing encrypted traffic.) Anyway, the idea of your comment is spot on, I think. The process whereby users blindly trust browser authors has serious flaws.…

And how would one know which certs to include? Seriously, I've been trying to solve that issue for years. Discussion on Super User (Stack Exchange): https://superuser.com/questions/818065/how-to-know-which-cer...

[deleted]

Re: Chrome's Plan to Distrust Symantec Certificates

#159

Post by mehrdadn »

hannob wrote: post #155
grandalf wrote: post #74

I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse. The incentive for a mass-market browser is to trust pretty much everything, but I'd prefer to use a browser that is a bit more paranoid. If a website can't load properly because I don't trust one or more of the CAs, I mi…

> I wish browser vendors would let me choose a trusted entity and make it simple for me to trust only CAs that my trusted entity supports, or the intersection of what multiple trusted entities endorse. This is an idea that I hear in variations from time to time, yet I think it's utterly wrong and goes against everything we know about IT security UI. The reason why HTTPS works at scale and is - with all its weaknesses…

Not really. To be honest, the existing UX for trust relationships is hardly near optimal. Nobody needs to understand what CAs and PKIs are. I actually think the proper UI could make it pretty smooth and understandable by the layperson. All a user needs to be asked is "Whom would you trust to certify that the websites you visit are genuinely those they claim to be?" and be presented with a few reasonable options, such as perhaps (1) Default (recommended), (2) Certification companies (Verisign, Thawte, etc.), (3) Government agencies (e.g. CIA, NSA, etc.), (4) Other/Custom (advanced).

Re: Chrome's Plan to Distrust Symantec Certificates

#160

Post by mintplant »

ajr0 wrote: post #37
mtgx wrote: post #26

I want to thank the Chrome people that continued to investigate the initial issues with Symantec certificates rather than just take their word for it that it was a honest one-time mistake. I imagine there has been a lot of tension between Google and Symantec over the past year because of this, so it must not have been easy to keep poking at Symantec. After all, Symantec almost was one of the "too big too fail" CAs. A…

To add to this sentiment. I think routine checks should done to all CAs, they are an important part of how "trust" works on the internet. and I see their importance only growing at this point. Google should not be the only company trying to enact change in this area. [edit: so many typos - oops]

> Google should not be the only company trying to enact change in this area.

Fortunately they're not. Mozilla is involved here as well; just look at [0] and the other *.mozilla.org links in this thread. They also broke the WoSign/StartCom debacle.

[0] https://wiki.mozilla.org/CA:Symantec_Issues

Post reply on HN