One of the happiest days of my life was when a Symantec support person, very courteously, helped me remove every Symantec product from my computer.
Chrome's Plan to Distrust Symantec Certificates
11–20 of 207 posts
Re: Chrome's Plan to Distrust Symantec Certificates
#12"including Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL" RIP RapidSSL wildcard
LE Wildcards should be around by then! Hopefully enough tooling will exist to make that migration seamless, or as seamless as cert migration can be.
Re: Chrome's Plan to Distrust Symantec Certificates
#13"including Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL" RIP RapidSSL wildcard
DigiCert is taking over the cert issuing infrastructure on Dec. 1st, so presumably those brands are coming along for the ride.
Re: Chrome's Plan to Distrust Symantec Certificates
#14Interesting RCA from Symantec on the originating incident: https://bug1334377.bmoattachments.org/attachment.cgi?id=8831... (PDF)
Also, they provided several Q&A-style responses as well:
https://bug1334377.bmoattachments.org/attachment.cgi?id=8831...
https://bug1334377.bmoattachments.org/attachment.cgi?id=8836...
https://bug1334377.bmoattachments.org/attachment.cgi?id=8838...
Re: Chrome's Plan to Distrust Symantec Certificates
#15Earlier quoted context omitted.
When will google decide let's encrypt is not secure enough and start giving a warning around that.
Considering Google is a major sponsor of the project, I'd say likely never. Not to mention that Google has been pushing hard for https on all sites, which is exactly LE's goal.
Not only that, but they're doing things like Certificate Transparency - publishing every certificate they sign into public logs and they're funded and supported by some of the biggest names in online security and privacy.
They're probably the most trustworthy CA on the planet.
Re: Chrome's Plan to Distrust Symantec Certificates
#16I realize that the title here is what Google put on their blog, but it seems to me that "detrust" would be more accurate than "distrust".
Re: Chrome's Plan to Distrust Symantec Certificates
#17I realize that the title here is what Google put on their blog, but it seems to me that "detrust" would be more accurate than "distrust".
“distrust” is an established English words that means exactly what Google intends. “detrust” is, while not hard to figure out, an unnecessary neologism.
Re: Chrome's Plan to Distrust Symantec Certificates
#18If you are using the free SSL provided your Webhost "Let's Encrypt" certificate, you will be fine. That is not a Symantec cert.
When will google decide let's encrypt is not secure enough and start giving a warning around that.
Considering how bad these violations were, and how carefully FF and Chrome are documenting everything, I'd say about never.
Re: Chrome's Plan to Distrust Symantec Certificates
#19"including Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL" RIP RapidSSL wildcard
LE Wildcards should be around by then! Hopefully enough tooling will exist to make that migration seamless, or as seamless as cert migration can be.
LE wildcards are coming early 2018 I believe so you'll still have a month or two gap.
Re: Chrome's Plan to Distrust Symantec Certificates
#20I realize that the title here is what Google put on their blog, but it seems to me that "detrust" would be more accurate than "distrust".
“distrust” is an established English words that means exactly what Google intends. “detrust” is, while not hard to figure out, an unnecessary neologism.
But "distrust" doesn't convey the full meaning. They're not talking about merely not trusting Symantec certificates; they're talking about removing existing trust in the certificates.