4 ms·

It makes me* uncomfortable that Google has effectively appointed themselves as the internet police and using their power to push people around like this. But a

by evmar 11y ago

It makes me* uncomfortable that Google has effectively appointed themselves as the internet police and using their power to push people around like this. But at the same time, there is nobody else (?) who is taking care of this, and I suppose the good of someone/anyone looking into and taking action on the sorts of serious problems that Symantec has exhibited probably outweighs my discomfort. * Disclaimer: Google employee, no connection to any of this cert stuff.

detaro 11y ago
All browser vendors IMHO should do exactly this. The CAs want them to entrust them with their customers secrets, they should make sure the CAs they accept work properly.
- voltagex_ 11y ago
  I'm not sure. There's no real deliniation between Chrome and Google (as brands / entities) - this seems like Google exerting power over another company. I have no love for Symantec but it doesn't feel right. I wonder if private negotiations have failed and this is Google trying to push the point? Can you imagine if Mozilla tried the same stuff? I mean, they don't trust CACert any more after CACert wasn't able to verify itself (?) adequately, but this is on a different order of magnitude.
  - Titanous 11y ago
    Mozilla runs a root program that regularly enforces similar requirements on CAs. For example, they are currently discussing whether they will require the same of Symantec as Google or even more: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/Hkyg_09EDYE https://groups.google.com/forum/#!topic/mozilla.dev.security... And here is a thread about a Chinese government CA that mis-issued certificates for Google domains: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/czwlDNbwHXM https://groups.google.com/forum/#!topic/mozilla.dev.security...
  - detaro 11y ago
    The alternative, not trusting their certs immediately instead of giving them additional requirements, would also be "exerting power over antother company". Mozilla has done so in the past, and I hope they will do so in the future. Google's argumentation that Symantec apparantly isn't able to properly assess themselves seems sound to me: if after being told about a specific issue they still are not capable of finding all instances of it happening, while outsiders can do so with the published information, then they they are missing critical abilities in this regard.
  - icebraining 11y ago
    Mozilla was much more forceful when they removed a CA from their default certificate list earlier this year, for lacking in their audits[1], when the post indicates no suspicion of wrong certificate emission. Compared to that, Google just forcing Symantec to be externally audited after it was shown that, not only have they issued wrong certificates, but also that they are unable to properly audit themselves, is being soft on them. [1] https://blog.mozilla.org/security/2015/04/27/removing-e-guven-ca-certificate/ https://blog.mozilla.org/security/2015/04/27/removing-e-guve...
    - dlgeek 11y ago
      I think that's less about the browser vendor and more about the CA. The Symantec CAs are the most widely used on the internet (They bought Verisign's CA business and roots) and are used on 4 of the Alexa Top 10 websites (so I'd assume a similar percentage of the rest). If a browser vendor just kicked them out, users would abandon that browser - just imagine if 40% of your common websites stopped working.
      - pilif 11y ago
        I was thinking about this. They could special-case it to not allow any certificates issued past some cutoff-date. This way the existing internet continues to work but who is going to renew a certificate, knowing it's not going to work in the browser with the biggest market share?
  - vtlynch 11y ago
    Google distributes Chrome, and it is 100% their choice to determine what certificates they want to trust and how they will do so. Just as its Microsoft's decision to do the same for Windows.
    - politician 11y ago
      Well, no, it's 100% _my_ choice what certificates that I want to accept on my physical devices, but I'm happy to indulge Google's suggested defaults.
      - toomuchtodo 11y ago
        True, but you are a rounding error. Almost everyone who uses Chrome is using whatever defaults it provides for CAs, ciphers, etc.
Natanael_L 11y ago
The explanations for why they are doing it that I've seen so far covers that Google is involved in all parts of the problem. Embedded devices, servers, network stacks, now ISP, carrier, laptops (chromebook), web apps, etc... They need all parts to work optimally and securely, and they get to feel the heat themselves for everything that's suboptimal. So they're working on fixing all of it.
Titanous 11y ago
This is how the public certificate authority system is set up. The client vendors (Google, Microsoft, Apple, Mozilla) choose what the rules are for trusting a Certificate Authority and which ones meet the requirements. These "root programs" are the only thing that prevents rogue/incompetent CAs from mis-issuing certificates on a regular basis. Since the CA business model is based on selling digital signatures that meet specific requirements, the threat of those certificates not working as advertised is compelling. On the other hand, the client vendors can't go overboard with requirements on existing "too big too fail" CAs because the alternative is having large portions of the Internet stop working in their products due to untrusted certificates. Edited to add: Google doesn't run its own root program, they use the OS root store, which will be from Apple, Microsoft, or Mozilla (most Linux distros use the Mozilla list). This means that the requirements from Google are in addition to those of the OS that is being used.
- andmarios 11y ago
  AFAIK Chrome comes with its own NSS certificate store and doesn't respect the system certificates. Firefox does the same.
  - vtlynch 11y ago
    I believe Chrome uses the underlying system trust store but also has its own list that it uses where Google wants to be stricter/do its own thing.
    - andmarios 11y ago
      Hmm, searched a bit and it seems only on Linux Chrome doesn't respect the system certificates but relies on Mozilla's NSS store. Still, extremely annoying since NSS isn't where system certificates are stored on Linux.
      - gsnedders 11y ago
        It's too easy to get certs into the root store of most distros, which means they're not practically usable for secure communication. There's often no auditing of the CAs to ensure they are taking due care to minimise risk of a bogus certificate being issued. [1] To be fair, some things have improved: Debian (and maybe Ubuntu) now have the Mozilla trust store plus one additional root (SPI). That said, all you need is one bad actor for the system to fail, and it seems the only reason why SPI is there is Debian infrastructure relies on it—but that doesn't make SPI trustworthy. [2] [1]: https://plus.google.com/105761279104103278252/posts/eVdB6X3NpPg https://plus.google.com/105761279104103278252/posts/eVdB6X3N... [2]: http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certificates.git;a=blob;f=debian/README.Debian http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certific...
mtgx 11y ago
We need leaders in security on the Web to push things forward. Otherwise we'd still be stuck with RC4 and MD5 (and in fact we still are because nobody has taken such drastic actions to force them to move...in the past 10 years since they've been made obsolete).
colechristensen 11y ago
If vendors and industry groups don't regulate themselves, some form of government will do it and likely the consequences of that won't be liked.
deleted 11y ago
[deleted]
glass- 11y ago
It makes me uncomfortable that the CA system is set up in a way that makes this necessary. If an alternative, such as Convergence, had taken off we wouldn't be in this situation.
- vtlynch 11y ago
  If an alternative, such as Convergence, was perfect, it would have taken off.
  - corndoge 11y ago
    This argument is valid only if you implicitly assert that the current system is perfect. Every system has it's trade-offs.
    - vtlynch 11y ago
      exactly. thats what makes the parent comment so preposterous.
      - cgriswald 11y ago
        If this is your argument it also requires the assumption that the trade-offs with Convergence are identical in both scale and type to the current system; at least in reference to this specific problem.
- late2part 11y ago
  If it were done another way, wouldn't it make it hard for the Governments to use NSL-like methods to surreptitiously masquerade as others?
Navarr 11y ago
I don't see it as Google policing, but more so the industry self-policing. Google relies on certificates being accurate as much as we do, it's in everyone's interest for this to be happening. Though I do admit I can see a slippery slope argument with Google's power.
geofft 11y ago
I'm okay with it for two reasons: 1. Google is already my personal internet police, as a Chrome user. Everything from which SSL stack to use, to whether and how to mitigate weak DH keys, to what NPAPI plugins to use, to whether my browser vendor is going off and signing contracts with Adobe about porting Flash to a brand-new runtime, to what sandboxing is in use, is in Google's hands. I suppose someone could, fairly easily, set themselves up as an intermediary between Google and me, auditing and patching Chromium if necessary, and running their own update server. (Arguably Linux distros do this.) And if so, they have the option of overriding these decisions. (And the Linux distros sometimes do, for things like the default trust store.) But so long as Google is writing this gigantic codebase that I couldn't possibly audit myself, they've not particularly gained any more power by caring about the CA system. 2. Google gets to be my personal internet police because Chrome is good; part of why I run Chrome (and I'm typing this from a Chromebook) is that out of all the participants in the market, I trust Google to be the best at protecting my security, in part because they've shown a willingness to do things like this, and in part because they're developing things like Certificate Transparency (and doing that negotiation with Adobe, and implementing seccomp mode 2, and so forth). I even prefer google-chrome to chromium on Debian, despite generally being a Debian fan, because I trust Google more to do quick security response and to make fewer mistakes. Google only gets to do this because Chrome is a choice by a significant fraction of internet users. Even Opera wouldn't be able to pull this off.

by evmar 11y ago

detaro 11y ago

All browser vendors IMHO should do exactly this. The CAs want them to entrust them with their customers secrets, they should make sure the CAs they accept work properly.

voltagex_ 11y ago
I'm not sure. There's no real deliniation between Chrome and Google (as brands / entities) - this seems like Google exerting power over another company. I have no love for Symantec but it doesn't feel right. I wonder if private negotiations have failed and this is Google trying to push the point? Can you imagine if Mozilla tried the same stuff? I mean, they don't trust CACert any more after CACert wasn't able to verify itself (?) adequately, but this is on a different order of magnitude.
- Titanous 11y ago
  Mozilla runs a root program that regularly enforces similar requirements on CAs. For example, they are currently discussing whether they will require the same of Symantec as Google or even more: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/Hkyg_09EDYE https://groups.google.com/forum/#!topic/mozilla.dev.security... And here is a thread about a Chinese government CA that mis-issued certificates for Google domains: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/czwlDNbwHXM https://groups.google.com/forum/#!topic/mozilla.dev.security...
- detaro 11y ago
  The alternative, not trusting their certs immediately instead of giving them additional requirements, would also be "exerting power over antother company". Mozilla has done so in the past, and I hope they will do so in the future. Google's argumentation that Symantec apparantly isn't able to properly assess themselves seems sound to me: if after being told about a specific issue they still are not capable of finding all instances of it happening, while outsiders can do so with the published information, then they they are missing critical abilities in this regard.
- icebraining 11y ago
  Mozilla was much more forceful when they removed a CA from their default certificate list earlier this year, for lacking in their audits[1], when the post indicates no suspicion of wrong certificate emission. Compared to that, Google just forcing Symantec to be externally audited after it was shown that, not only have they issued wrong certificates, but also that they are unable to properly audit themselves, is being soft on them. [1] https://blog.mozilla.org/security/2015/04/27/removing-e-guven-ca-certificate/ https://blog.mozilla.org/security/2015/04/27/removing-e-guve...
  - dlgeek 11y ago
    I think that's less about the browser vendor and more about the CA. The Symantec CAs are the most widely used on the internet (They bought Verisign's CA business and roots) and are used on 4 of the Alexa Top 10 websites (so I'd assume a similar percentage of the rest). If a browser vendor just kicked them out, users would abandon that browser - just imagine if 40% of your common websites stopped working.
    - pilif 11y ago
      I was thinking about this. They could special-case it to not allow any certificates issued past some cutoff-date. This way the existing internet continues to work but who is going to renew a certificate, knowing it's not going to work in the browser with the biggest market share?
- vtlynch 11y ago
  Google distributes Chrome, and it is 100% their choice to determine what certificates they want to trust and how they will do so. Just as its Microsoft's decision to do the same for Windows.
  - politician 11y ago
    Well, no, it's 100% _my_ choice what certificates that I want to accept on my physical devices, but I'm happy to indulge Google's suggested defaults.
    - toomuchtodo 11y ago
      True, but you are a rounding error. Almost everyone who uses Chrome is using whatever defaults it provides for CAs, ciphers, etc.

Natanael_L 11y ago

The explanations for why they are doing it that I've seen so far covers that Google is involved in all parts of the problem. Embedded devices, servers, network stacks, now ISP, carrier, laptops (chromebook), web apps, etc... They need all parts to work optimally and securely, and they get to feel the heat themselves for everything that's suboptimal. So they're working on fixing all of it.

Titanous 11y ago

This is how the public certificate authority system is set up. The client vendors (Google, Microsoft, Apple, Mozilla) choose what the rules are for trusting a Certificate Authority and which ones meet the requirements. These "root programs" are the only thing that prevents rogue/incompetent CAs from mis-issuing certificates on a regular basis. Since the CA business model is based on selling digital signatures that meet specific requirements, the threat of those certificates not working as advertised is compelling. On the other hand, the client vendors can't go overboard with requirements on existing "too big too fail" CAs because the alternative is having large portions of the Internet stop working in their products due to untrusted certificates. Edited to add: Google doesn't run its own root program, they use the OS root store, which will be from Apple, Microsoft, or Mozilla (most Linux distros use the Mozilla list). This means that the requirements from Google are in addition to those of the OS that is being used.

andmarios 11y ago
AFAIK Chrome comes with its own NSS certificate store and doesn't respect the system certificates. Firefox does the same.
- vtlynch 11y ago
  I believe Chrome uses the underlying system trust store but also has its own list that it uses where Google wants to be stricter/do its own thing.
  - andmarios 11y ago
    Hmm, searched a bit and it seems only on Linux Chrome doesn't respect the system certificates but relies on Mozilla's NSS store. Still, extremely annoying since NSS isn't where system certificates are stored on Linux.
    - gsnedders 11y ago
      It's too easy to get certs into the root store of most distros, which means they're not practically usable for secure communication. There's often no auditing of the CAs to ensure they are taking due care to minimise risk of a bogus certificate being issued. [1] To be fair, some things have improved: Debian (and maybe Ubuntu) now have the Mozilla trust store plus one additional root (SPI). That said, all you need is one bad actor for the system to fail, and it seems the only reason why SPI is there is Debian infrastructure relies on it—but that doesn't make SPI trustworthy. [2] [1]: https://plus.google.com/105761279104103278252/posts/eVdB6X3NpPg https://plus.google.com/105761279104103278252/posts/eVdB6X3N... [2]: http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certificates.git;a=blob;f=debian/README.Debian http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certific...

mtgx 11y ago

We need leaders in security on the Web to push things forward. Otherwise we'd still be stuck with RC4 and MD5 (and in fact we still are because nobody has taken such drastic actions to force them to move...in the past 10 years since they've been made obsolete).

colechristensen 11y ago

If vendors and industry groups don't regulate themselves, some form of government will do it and likely the consequences of that won't be liked.

deleted 11y ago

[deleted]

glass- 11y ago

It makes me uncomfortable that the CA system is set up in a way that makes this necessary. If an alternative, such as Convergence, had taken off we wouldn't be in this situation.

vtlynch 11y ago
If an alternative, such as Convergence, was perfect, it would have taken off.
- corndoge 11y ago
  This argument is valid only if you implicitly assert that the current system is perfect. Every system has it's trade-offs.
  - vtlynch 11y ago
    exactly. thats what makes the parent comment so preposterous.
    - cgriswald 11y ago
      If this is your argument it also requires the assumption that the trade-offs with Convergence are identical in both scale and type to the current system; at least in reference to this specific problem.
late2part 11y ago
If it were done another way, wouldn't it make it hard for the Governments to use NSL-like methods to surreptitiously masquerade as others?

Navarr 11y ago

I don't see it as Google policing, but more so the industry self-policing. Google relies on certificates being accurate as much as we do, it's in everyone's interest for this to be happening. Though I do admit I can see a slippery slope argument with Google's power.

geofft 11y ago

I'm okay with it for two reasons: 1. Google is already my personal internet police, as a Chrome user. Everything from which SSL stack to use, to whether and how to mitigate weak DH keys, to what NPAPI plugins to use, to whether my browser vendor is going off and signing contracts with Adobe about porting Flash to a brand-new runtime, to what sandboxing is in use, is in Google's hands. I suppose someone could, fairly easily, set themselves up as an intermediary between Google and me, auditing and patching Chromium if necessary, and running their own update server. (Arguably Linux distros do this.) And if so, they have the option of overriding these decisions. (And the Linux distros sometimes do, for things like the default trust store.) But so long as Google is writing this gigantic codebase that I couldn't possibly audit myself, they've not particularly gained any more power by caring about the CA system. 2. Google gets to be my personal internet police because Chrome is good; part of why I run Chrome (and I'm typing this from a Chromebook) is that out of all the participants in the market, I trust Google to be the best at protecting my security, in part because they've shown a willingness to do things like this, and in part because they're developing things like Certificate Transparency (and doing that negotiation with Adobe, and implementing seccomp mode 2, and so forth). I even prefer google-chrome to chromium on Debian, despite generally being a Debian fan, because I trust Google more to do quick security response and to make fewer mistakes. Google only gets to do this because Chrome is a choice by a significant fraction of internet users. Even Opera wouldn't be able to pull this off.