22 ms·

TLDR: Google has lost trust in Symantec's ability to properly validate certificates they issue. Chrome has a Root Certificate Policy that expects a CA to perf

TLDR: Google has lost trust in Symantec's ability to properly validate certificates they issue. Chrome has a Root Certificate Policy that expects a CA to perform in a manner commensurate with the trust being placed in them and the Google team appears to see evidence that they are not living up to the standard laid out. They propose a gradual distrust of existing certificates by reducing the 'maximum age' of the certificates with each release of Chrome. EV certificates are proposed to have their EV indicators stripped immediately until Symantec, for one year, demonstrates sustained compliance.

spelunker 10y ago
The max time also starts at 33 months w/ Chrome 59 so thankfully they're giving plenty of time to either resolve the situation or have people switch CAs.
- specialp 10y ago
  Not really. By the end of the year with their schedule Chrome 64 will be out with 9 month validity. Then who knows after that. So it is at the most 18 months.
  - spelunker 10y ago
    You're right. I didn't look into the Chrome release schedule so I just assumed they followed the max validity deprecation schedule. My mistake.
DaiPlusPlus 10y ago
They're also planning on stripping EV status from their Certs too... that's going to be fun for a lot of banks.
- jlgaddis 10y ago
  "effective immediately"
  - ajnin 10y ago
    They mention the issue is treated as a "medium priority" security issue, which means it should land in the next stable version according to their guidelines (https://www.chromium.org/developers/severity-guidelines https://www.chromium.org/developers/severity-guidelines)
- dmix 10y ago
  Banks can just switch to better SSL services...
  - whorleater 10y ago
    Any large organization lacks the ability to "just switch" from one thing to another.
    - gcp 10y ago
      I'm fairly sure at least some of the "policy violations" that Symantec did were done exactly as a service to their large bank-or-close-enough customers. It's not that banks want to switch to a "better" SSL service, it's Symantec being a "better" service for them that got Symantec into trouble. (IIRC, from reading some of the incident reports)
      - DaiPlusPlus 10y ago
        Can you name some specific examples?
        gcp 10y ago
        IIRC several of the mis-issued SHA1 certs.
        iancarroll 10y ago
        Symantec took one of their widely trusted root certificates and declared that it was now "off the reservation", meaning they may choose to not comply with the BRs for its leaf certificates. I don't know if they have actively used it to issue SHA-1 certificates, but they certainly could.
        yuhong 10y ago
        You will notice that was also their SGC root, and one of the oldest roots that browsers trusted.
- unethical_ban 10y ago
  Oh no, of the 20 users that know about EV, 2 might send an email.
  - jdavis703 10y ago
    EV actually causes a different "secure" UI to display in the browser. Usually it is the name of the corporate entity that the certificate is issued for. If you don't have EV you only get a padlock.
    - clhodapp 10y ago
      Browsers make changes like that to their UIs all the time. I highly doubt that a member of the general public would notice the difference. Heck, I doubt most developers would notice.
      - lovelearning 10y ago
        I agree, because I experienced it just now. I'm on Chrome 57 and just realized that Chrome certificate details UI seems to have changed sometime recently. I remember I could earlier click on the padlock or "Secure" text, click More (or something) on the popup and it would display certificate details in developer tools (which is itself weird, but atleast it was available for end users). Now, it doesn't give any direct way to see certificate details. "Learn More" just opens a support page with vague details. The only way for a user to see details now is to explicitly launch developer tools. I find this logic a bit weird. Apparently, this is not a bug but a feature [1]. [1]: https://productforums.google.com/forum/#!topic/chrome/kPlY52CvNmg https://productforums.google.com/forum/#!topic/chrome/kPlY52...
        mvdwoord 10y ago
        You just made me look, and what I saw made me sad. Even more than I already was. :( "Let's remove this thing that is super useful while your stated goal could just as easily be reached while keeping the original functionality." Bill Hicks was so incredibly right about marketing.
tptacek 10y ago
This is a good summary, but I'd clarify it by saying that Google isn't being subjective about Symantec's process failures. The CA industry self-regulates. Its regulatory organization is the CA/B Forum, and their principal regulation is the Baseline Requirements (the BRs). Google claims Symantec violated multiple BRs. If you want to dig a little deeper, here's the last version of the BRs: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.4.2.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...
- londons_explore 10y ago
  Have they published anywhere the violations? Normally browser makers publish openly evidence of mis-issued certificates, together with having the discussion with the vendor in the public. It's sad that this announcement from Google seems to basically be saying "we had a closed door dispute with Symantec, and now don't trust them".
  - teraflop 10y ago
    The issue has gotten plenty of public discussion (from Google, Mozilla, and others) on Mozilla's dev-security-policy mailing list: https://groups.google.com/forum/?fromgroups=#!forum/mozilla.dev.security.policy https://groups.google.com/forum/?fromgroups=#!forum/mozilla....
    - caf 10y ago
      The main thread is https://groups.google.com/forum/?fromgroups=#!topic/mozilla.dev.security.policy/fyJ3EK2YOP8 https://groups.google.com/forum/?fromgroups=#!topic/mozilla.... , and it contains some nuggets like this: So after reading this, the following auditors aren't trusted by Symantec anymore: - E&Y Korea - E&Y Brazil The following isn't trusted by Mozilla anymore: - E&Y Hong Kong This seems to be a worrying trend to me. Kurt
      - kawsper 10y ago
        I was curious if E&Y was Ernst & Young, and indeed it is, apparently they go by the name of EY now. I found this attached PDF interesting as well: https://bug1334377.bmoattachments.org/attachment.cgi?id=8831038 https://bug1334377.bmoattachments.org/attachment.cgi?id=8831...

spelunker 10y ago

The max time also starts at 33 months w/ Chrome 59 so thankfully they're giving plenty of time to either resolve the situation or have people switch CAs.

specialp 10y ago
Not really. By the end of the year with their schedule Chrome 64 will be out with 9 month validity. Then who knows after that. So it is at the most 18 months.
- spelunker 10y ago
  You're right. I didn't look into the Chrome release schedule so I just assumed they followed the max validity deprecation schedule. My mistake.

DaiPlusPlus 10y ago

They're also planning on stripping EV status from their Certs too... that's going to be fun for a lot of banks.

jlgaddis 10y ago
"effective immediately"
- ajnin 10y ago
  They mention the issue is treated as a "medium priority" security issue, which means it should land in the next stable version according to their guidelines (https://www.chromium.org/developers/severity-guidelines https://www.chromium.org/developers/severity-guidelines)
dmix 10y ago
Banks can just switch to better SSL services...
- whorleater 10y ago
  Any large organization lacks the ability to "just switch" from one thing to another.
  - gcp 10y ago
    I'm fairly sure at least some of the "policy violations" that Symantec did were done exactly as a service to their large bank-or-close-enough customers. It's not that banks want to switch to a "better" SSL service, it's Symantec being a "better" service for them that got Symantec into trouble. (IIRC, from reading some of the incident reports)
    - DaiPlusPlus 10y ago
      Can you name some specific examples?
      - gcp 10y ago
        IIRC several of the mis-issued SHA1 certs.
      - iancarroll 10y ago
        Symantec took one of their widely trusted root certificates and declared that it was now "off the reservation", meaning they may choose to not comply with the BRs for its leaf certificates. I don't know if they have actively used it to issue SHA-1 certificates, but they certainly could.
        yuhong 10y ago
        You will notice that was also their SGC root, and one of the oldest roots that browsers trusted.
unethical_ban 10y ago
Oh no, of the 20 users that know about EV, 2 might send an email.
- jdavis703 10y ago
  EV actually causes a different "secure" UI to display in the browser. Usually it is the name of the corporate entity that the certificate is issued for. If you don't have EV you only get a padlock.
  - clhodapp 10y ago
    Browsers make changes like that to their UIs all the time. I highly doubt that a member of the general public would notice the difference. Heck, I doubt most developers would notice.
    - lovelearning 10y ago
      I agree, because I experienced it just now. I'm on Chrome 57 and just realized that Chrome certificate details UI seems to have changed sometime recently. I remember I could earlier click on the padlock or "Secure" text, click More (or something) on the popup and it would display certificate details in developer tools (which is itself weird, but atleast it was available for end users). Now, it doesn't give any direct way to see certificate details. "Learn More" just opens a support page with vague details. The only way for a user to see details now is to explicitly launch developer tools. I find this logic a bit weird. Apparently, this is not a bug but a feature [1]. [1]: https://productforums.google.com/forum/#!topic/chrome/kPlY52CvNmg https://productforums.google.com/forum/#!topic/chrome/kPlY52...
      - mvdwoord 10y ago
        You just made me look, and what I saw made me sad. Even more than I already was. :( "Let's remove this thing that is super useful while your stated goal could just as easily be reached while keeping the original functionality." Bill Hicks was so incredibly right about marketing.

tptacek 10y ago

This is a good summary, but I'd clarify it by saying that Google isn't being subjective about Symantec's process failures. The CA industry self-regulates. Its regulatory organization is the CA/B Forum, and their principal regulation is the Baseline Requirements (the BRs). Google claims Symantec violated multiple BRs. If you want to dig a little deeper, here's the last version of the BRs: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.4.2.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...

londons_explore 10y ago
Have they published anywhere the violations? Normally browser makers publish openly evidence of mis-issued certificates, together with having the discussion with the vendor in the public. It's sad that this announcement from Google seems to basically be saying "we had a closed door dispute with Symantec, and now don't trust them".
- teraflop 10y ago
  The issue has gotten plenty of public discussion (from Google, Mozilla, and others) on Mozilla's dev-security-policy mailing list: https://groups.google.com/forum/?fromgroups=#!forum/mozilla.dev.security.policy https://groups.google.com/forum/?fromgroups=#!forum/mozilla....
  - caf 10y ago
    The main thread is https://groups.google.com/forum/?fromgroups=#!topic/mozilla.dev.security.policy/fyJ3EK2YOP8 https://groups.google.com/forum/?fromgroups=#!topic/mozilla.... , and it contains some nuggets like this: So after reading this, the following auditors aren't trusted by Symantec anymore: - E&Y Korea - E&Y Brazil The following isn't trusted by Mozilla anymore: - E&Y Hong Kong This seems to be a worrying trend to me. Kurt
    - kawsper 10y ago
      I was curious if E&Y was Ernst & Young, and indeed it is, apparently they go by the name of EY now. I found this attached PDF interesting as well: https://bug1334377.bmoattachments.org/attachment.cgi?id=8831038 https://bug1334377.bmoattachments.org/attachment.cgi?id=8831...