3 ms·

I'm not sure. There's no real deliniation between Chrome and Google (as brands / entities) - this seems like Google exerting power over another company. I have

I'm not sure. There's no real deliniation between Chrome and Google (as brands / entities) - this seems like Google exerting power over another company. I have no love for Symantec but it doesn't feel right. I wonder if private negotiations have failed and this is Google trying to push the point? Can you imagine if Mozilla tried the same stuff? I mean, they don't trust CACert any more after CACert wasn't able to verify itself (?) adequately, but this is on a different order of magnitude.

Titanous 11y ago
Mozilla runs a root program that regularly enforces similar requirements on CAs. For example, they are currently discussing whether they will require the same of Symantec as Google or even more: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/Hkyg_09EDYE https://groups.google.com/forum/#!topic/mozilla.dev.security... And here is a thread about a Chinese government CA that mis-issued certificates for Google domains: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/czwlDNbwHXM https://groups.google.com/forum/#!topic/mozilla.dev.security...
detaro 11y ago
The alternative, not trusting their certs immediately instead of giving them additional requirements, would also be "exerting power over antother company". Mozilla has done so in the past, and I hope they will do so in the future. Google's argumentation that Symantec apparantly isn't able to properly assess themselves seems sound to me: if after being told about a specific issue they still are not capable of finding all instances of it happening, while outsiders can do so with the published information, then they they are missing critical abilities in this regard.
icebraining 11y ago
Mozilla was much more forceful when they removed a CA from their default certificate list earlier this year, for lacking in their audits[1], when the post indicates no suspicion of wrong certificate emission. Compared to that, Google just forcing Symantec to be externally audited after it was shown that, not only have they issued wrong certificates, but also that they are unable to properly audit themselves, is being soft on them. [1] https://blog.mozilla.org/security/2015/04/27/removing-e-guven-ca-certificate/ https://blog.mozilla.org/security/2015/04/27/removing-e-guve...
- dlgeek 11y ago
  I think that's less about the browser vendor and more about the CA. The Symantec CAs are the most widely used on the internet (They bought Verisign's CA business and roots) and are used on 4 of the Alexa Top 10 websites (so I'd assume a similar percentage of the rest). If a browser vendor just kicked them out, users would abandon that browser - just imagine if 40% of your common websites stopped working.
  - pilif 11y ago
    I was thinking about this. They could special-case it to not allow any certificates issued past some cutoff-date. This way the existing internet continues to work but who is going to renew a certificate, knowing it's not going to work in the browser with the biggest market share?
vtlynch 11y ago
Google distributes Chrome, and it is 100% their choice to determine what certificates they want to trust and how they will do so. Just as its Microsoft's decision to do the same for Windows.
- politician 11y ago
  Well, no, it's 100% _my_ choice what certificates that I want to accept on my physical devices, but I'm happy to indulge Google's suggested defaults.
  - toomuchtodo 11y ago
    True, but you are a rounding error. Almost everyone who uses Chrome is using whatever defaults it provides for CAs, ciphers, etc.

Titanous 11y ago

Mozilla runs a root program that regularly enforces similar requirements on CAs. For example, they are currently discussing whether they will require the same of Symantec as Google or even more: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/Hkyg_09EDYE https://groups.google.com/forum/#!topic/mozilla.dev.security... And here is a thread about a Chinese government CA that mis-issued certificates for Google domains: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/czwlDNbwHXM https://groups.google.com/forum/#!topic/mozilla.dev.security...

detaro 11y ago

The alternative, not trusting their certs immediately instead of giving them additional requirements, would also be "exerting power over antother company". Mozilla has done so in the past, and I hope they will do so in the future. Google's argumentation that Symantec apparantly isn't able to properly assess themselves seems sound to me: if after being told about a specific issue they still are not capable of finding all instances of it happening, while outsiders can do so with the published information, then they they are missing critical abilities in this regard.

icebraining 11y ago

Mozilla was much more forceful when they removed a CA from their default certificate list earlier this year, for lacking in their audits[1], when the post indicates no suspicion of wrong certificate emission. Compared to that, Google just forcing Symantec to be externally audited after it was shown that, not only have they issued wrong certificates, but also that they are unable to properly audit themselves, is being soft on them. [1] https://blog.mozilla.org/security/2015/04/27/removing-e-guven-ca-certificate/ https://blog.mozilla.org/security/2015/04/27/removing-e-guve...

dlgeek 11y ago
I think that's less about the browser vendor and more about the CA. The Symantec CAs are the most widely used on the internet (They bought Verisign's CA business and roots) and are used on 4 of the Alexa Top 10 websites (so I'd assume a similar percentage of the rest). If a browser vendor just kicked them out, users would abandon that browser - just imagine if 40% of your common websites stopped working.
- pilif 11y ago
  I was thinking about this. They could special-case it to not allow any certificates issued past some cutoff-date. This way the existing internet continues to work but who is going to renew a certificate, knowing it's not going to work in the browser with the biggest market share?

vtlynch 11y ago

Google distributes Chrome, and it is 100% their choice to determine what certificates they want to trust and how they will do so. Just as its Microsoft's decision to do the same for Windows.

politician 11y ago
Well, no, it's 100% _my_ choice what certificates that I want to accept on my physical devices, but I'm happy to indulge Google's suggested defaults.
- toomuchtodo 11y ago
  True, but you are a rounding error. Almost everyone who uses Chrome is using whatever defaults it provides for CAs, ciphers, etc.