8 ms·

They're also planning on stripping EV status from their Certs too... that's going to be fun for a lot of banks.

by DaiPlusPlus 10y ago

jlgaddis 10y ago
"effective immediately"
- ajnin 10y ago
  They mention the issue is treated as a "medium priority" security issue, which means it should land in the next stable version according to their guidelines (https://www.chromium.org/developers/severity-guidelines https://www.chromium.org/developers/severity-guidelines)
dmix 10y ago
Banks can just switch to better SSL services...
- whorleater 10y ago
  Any large organization lacks the ability to "just switch" from one thing to another.
  - gcp 10y ago
    I'm fairly sure at least some of the "policy violations" that Symantec did were done exactly as a service to their large bank-or-close-enough customers. It's not that banks want to switch to a "better" SSL service, it's Symantec being a "better" service for them that got Symantec into trouble. (IIRC, from reading some of the incident reports)
    - DaiPlusPlus 10y ago
      Can you name some specific examples?
      - gcp 10y ago
        IIRC several of the mis-issued SHA1 certs.
      - iancarroll 10y ago
        Symantec took one of their widely trusted root certificates and declared that it was now "off the reservation", meaning they may choose to not comply with the BRs for its leaf certificates. I don't know if they have actively used it to issue SHA-1 certificates, but they certainly could.
        yuhong 10y ago
        You will notice that was also their SGC root, and one of the oldest roots that browsers trusted.
        DaiPlusPlus 10y ago
        But how or why was this done as a favour for their banking customers?
        iancarroll 10y ago
        Banks and companies like First Data were the (sole?) source of exception requests for SHA-1 issuance past the date it was prohibited. Given the G1 root they pulled has an intermediary called "Symantec Trust Services Private SHA1 Root CA", I can make some guesses...
        agwa 10y ago
        The exception process used by payment processors such as First Data were for SHA-1 certificates chaining to a root that was still publicly-trusted. They couldn't use an off-reservation root because their client devices didn't trust them. The roots that Symantec took off-reservation are regularly issuing SHA-1 certificates to anyone whose check clears. Got $1,699 to spare? https://www.thesslstore.com/symantec/secure-site-pro-sha1-private.aspx https://www.thesslstore.com/symantec/secure-site-pro-sha1-pr...
  - ergothus 10y ago
    I agree. However, there's no point in pretending these certs are good if we can't trust the issuer to not put out BAD certs. Painful or not, if the banks are user the certs to show they are trustworthy, then they need to switch when the issuer ISN'T trustworthy.
  - cortesoft 10y ago
    Not always, although it depends on what you are changing. I work for a 200,000 person company, and switching cert providers would not be a huge task. We have done it before.
- ygjb 10y ago
  ha.ha.ha. I worked at a financial institution for several years. There are many, many IT folks, internal auditors, and others who are probably wishing they wore their brown pants to work today. SSL certificates are cheap in contrast to the labour intensive management practices that exist around them, especially around legacy platforms that may have been hardcoded to use certificates from a specific issuer (not that I have ever seen that before, no one would be that foolish right? :/)
  - Sir_Substance 10y ago
    >especially around legacy platforms that may have been hardcoded to use certificates from a specific issuer (not that I have ever seen that before, no one would be that foolish right? :/) D'ya know, I would have naively assumed this wasn't technically possible. I shudder not only to think of the code, but also of the thought process that could compel someone to undergo the effort of bricking themselves into this corner because honestly, that sounds a lot harder than doing it right.
    - DaiPlusPlus 10y ago
      It happened to me - I was working on an application for the pre-paid electricty system in Texas: the server-side code connects to a data-source over a TLS connection (complete with client-side certificates too), except the server-side used a self-signed certificate, and my code didn't have admin/root rights on the client hardware so it had to use in-app certification verification code. I had to hard-code the root CA's fingerprints directly into my code so it would be baked into the signed binary (this was a project requirement). That thing is going to fall-apart if the root CA ever changes - fortunately it won't expire until 2099. (Yes, I gave the client a strongly worded statement of my misgivings - and all the other bad code-smells in the project)
      - pauldino 10y ago
        So basically you're pinning the server certificate chain into your signed client code? Actually that sounds like a good thing! https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning https://www.owasp.org/index.php/Certificate_and_Public_Key_P...
- Animats 10y ago
  Somebody needs to tell Bank of America. They're still presenting a Symantec EV cert.
  - uzoodoo 10y ago
    So is Chase, Citi, PNC, Schwab, TD, ...
unethical_ban 10y ago
Oh no, of the 20 users that know about EV, 2 might send an email.
- jdavis703 10y ago
  EV actually causes a different "secure" UI to display in the browser. Usually it is the name of the corporate entity that the certificate is issued for. If you don't have EV you only get a padlock.
  - clhodapp 10y ago
    Browsers make changes like that to their UIs all the time. I highly doubt that a member of the general public would notice the difference. Heck, I doubt most developers would notice.
    - lovelearning 10y ago
      I agree, because I experienced it just now. I'm on Chrome 57 and just realized that Chrome certificate details UI seems to have changed sometime recently. I remember I could earlier click on the padlock or "Secure" text, click More (or something) on the popup and it would display certificate details in developer tools (which is itself weird, but atleast it was available for end users). Now, it doesn't give any direct way to see certificate details. "Learn More" just opens a support page with vague details. The only way for a user to see details now is to explicitly launch developer tools. I find this logic a bit weird. Apparently, this is not a bug but a feature [1]. [1]: https://productforums.google.com/forum/#!topic/chrome/kPlY52CvNmg https://productforums.google.com/forum/#!topic/chrome/kPlY52...
      - mvdwoord 10y ago
        You just made me look, and what I saw made me sad. Even more than I already was. :( "Let's remove this thing that is super useful while your stated goal could just as easily be reached while keeping the original functionality." Bill Hicks was so incredibly right about marketing.

They're also planning on stripping EV status from their Certs too... that's going to be fun for a lot of banks.

jlgaddis 10y ago

"effective immediately"

ajnin 10y ago
They mention the issue is treated as a "medium priority" security issue, which means it should land in the next stable version according to their guidelines (https://www.chromium.org/developers/severity-guidelines https://www.chromium.org/developers/severity-guidelines)

dmix 10y ago

Banks can just switch to better SSL services...

whorleater 10y ago
Any large organization lacks the ability to "just switch" from one thing to another.
- gcp 10y ago
  I'm fairly sure at least some of the "policy violations" that Symantec did were done exactly as a service to their large bank-or-close-enough customers. It's not that banks want to switch to a "better" SSL service, it's Symantec being a "better" service for them that got Symantec into trouble. (IIRC, from reading some of the incident reports)
  - DaiPlusPlus 10y ago
    Can you name some specific examples?
    - gcp 10y ago
      IIRC several of the mis-issued SHA1 certs.
    - iancarroll 10y ago
      Symantec took one of their widely trusted root certificates and declared that it was now "off the reservation", meaning they may choose to not comply with the BRs for its leaf certificates. I don't know if they have actively used it to issue SHA-1 certificates, but they certainly could.
      - yuhong 10y ago
        You will notice that was also their SGC root, and one of the oldest roots that browsers trusted.
      - DaiPlusPlus 10y ago
        But how or why was this done as a favour for their banking customers?
        iancarroll 10y ago
        Banks and companies like First Data were the (sole?) source of exception requests for SHA-1 issuance past the date it was prohibited. Given the G1 root they pulled has an intermediary called "Symantec Trust Services Private SHA1 Root CA", I can make some guesses...
        agwa 10y ago
        The exception process used by payment processors such as First Data were for SHA-1 certificates chaining to a root that was still publicly-trusted. They couldn't use an off-reservation root because their client devices didn't trust them. The roots that Symantec took off-reservation are regularly issuing SHA-1 certificates to anyone whose check clears. Got $1,699 to spare? https://www.thesslstore.com/symantec/secure-site-pro-sha1-private.aspx https://www.thesslstore.com/symantec/secure-site-pro-sha1-pr...
- ergothus 10y ago
  I agree. However, there's no point in pretending these certs are good if we can't trust the issuer to not put out BAD certs. Painful or not, if the banks are user the certs to show they are trustworthy, then they need to switch when the issuer ISN'T trustworthy.
- cortesoft 10y ago
  Not always, although it depends on what you are changing. I work for a 200,000 person company, and switching cert providers would not be a huge task. We have done it before.
ygjb 10y ago
ha.ha.ha. I worked at a financial institution for several years. There are many, many IT folks, internal auditors, and others who are probably wishing they wore their brown pants to work today. SSL certificates are cheap in contrast to the labour intensive management practices that exist around them, especially around legacy platforms that may have been hardcoded to use certificates from a specific issuer (not that I have ever seen that before, no one would be that foolish right? :/)
- Sir_Substance 10y ago
  >especially around legacy platforms that may have been hardcoded to use certificates from a specific issuer (not that I have ever seen that before, no one would be that foolish right? :/) D'ya know, I would have naively assumed this wasn't technically possible. I shudder not only to think of the code, but also of the thought process that could compel someone to undergo the effort of bricking themselves into this corner because honestly, that sounds a lot harder than doing it right.
  - DaiPlusPlus 10y ago
    It happened to me - I was working on an application for the pre-paid electricty system in Texas: the server-side code connects to a data-source over a TLS connection (complete with client-side certificates too), except the server-side used a self-signed certificate, and my code didn't have admin/root rights on the client hardware so it had to use in-app certification verification code. I had to hard-code the root CA's fingerprints directly into my code so it would be baked into the signed binary (this was a project requirement). That thing is going to fall-apart if the root CA ever changes - fortunately it won't expire until 2099. (Yes, I gave the client a strongly worded statement of my misgivings - and all the other bad code-smells in the project)
    - pauldino 10y ago
      So basically you're pinning the server certificate chain into your signed client code? Actually that sounds like a good thing! https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning https://www.owasp.org/index.php/Certificate_and_Public_Key_P...
Animats 10y ago
Somebody needs to tell Bank of America. They're still presenting a Symantec EV cert.
- uzoodoo 10y ago
  So is Chase, Citi, PNC, Schwab, TD, ...

unethical_ban 10y ago

Oh no, of the 20 users that know about EV, 2 might send an email.

jdavis703 10y ago
EV actually causes a different "secure" UI to display in the browser. Usually it is the name of the corporate entity that the certificate is issued for. If you don't have EV you only get a padlock.
- clhodapp 10y ago
  Browsers make changes like that to their UIs all the time. I highly doubt that a member of the general public would notice the difference. Heck, I doubt most developers would notice.
  - lovelearning 10y ago
    I agree, because I experienced it just now. I'm on Chrome 57 and just realized that Chrome certificate details UI seems to have changed sometime recently. I remember I could earlier click on the padlock or "Secure" text, click More (or something) on the popup and it would display certificate details in developer tools (which is itself weird, but atleast it was available for end users). Now, it doesn't give any direct way to see certificate details. "Learn More" just opens a support page with vague details. The only way for a user to see details now is to explicitly launch developer tools. I find this logic a bit weird. Apparently, this is not a bug but a feature [1]. [1]: https://productforums.google.com/forum/#!topic/chrome/kPlY52CvNmg https://productforums.google.com/forum/#!topic/chrome/kPlY52...
    - mvdwoord 10y ago
      You just made me look, and what I saw made me sad. Even more than I already was. :( "Let's remove this thing that is super useful while your stated goal could just as easily be reached while keeping the original functionality." Bill Hicks was so incredibly right about marketing.