Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate

Post by yuhong » Wed, Nov 16, 2016, 8:34 PM UTC

asclepi wrote: post #89

swalsh wrote: post #24

Earlier quoted context omitted.

Is there any reason, in 2016, to use Symantec over LetsEncrypt?

Apart from the reasons posted earlier, "legacy" also comes into play. Symantec acquired the CA business from the old VeriSign in 2010, which back then was the largest CA and had a large corporate client portfolio accustomed to paying $$$$ per certificate per year. Corporations can become very reluctant to change, even if it benefits them, and there are some who just pay up every year without researching alternatives…

Post by yuhong » Thu, Nov 17, 2016, 1:02 AM UTC

gcb0 wrote: post #79

darklajid wrote: post #48

Earlier quoted context omitted.

» When Chrome starts up, it fetches a list of feature flags from a Chrome server using a system called Finch which is independent of the normal upgrade system. I'm not a Chrome user. But that sounds awful at first. What is the idea behind this service? Is there any documentation about the 'features' these flags can enable/disable? I understand that I'm paranoid at times AND I really dislike Google, but why would you…

because Google don't know bugs on your (their) browser affecting their revenue. interesting, if you're a victim of mitm attacks, i wonder if attackers can abuse that to disable some certificate check features to make spoofing ssl sites easier.

Post by gcb0 » Mon, Nov 21, 2016, 1:13 AM UTC

wfunction wrote: post #94

gcb0 wrote: post #81

Earlier quoted context omitted.

> using a Google browser > not wanting to be tracked here's a hint: ad impression for unknown user is 0.01$ and for logged in user 2$. guess why Google has a browser now...

Do you mean logged into Chrome (e.g. profile sync)? or just logged into Gmail?