5 ms·

or 3) Large websites using Symantec certs start telling users Chrome is "broken" and we find out if users will switch browsers, not care about the security, an

or 3) Large websites using Symantec certs start telling users Chrome is "broken" and we find out if users will switch browsers, not care about the security, and/or complain to the sites. I definitely find any variation of #3 to be more likely than #2. I see it as a battle between #1 and #3.

jasode 10y ago
>Large websites using Symantec certs start telling users Chrome is "broken" I'm having a hard time thinking of a scenario where a large website concludes it's cheaper to convince web shoppers at ecommerce sites and web visitors at news sites to switch to Firefox/IE instead of the website just switching CA vendors. If you're a website that wants to put up zero friction between buyers submitting their credit-card info and pay you money, why try to "educate" them? If you're a website that wants visitors to see your ads next to your journalists' stories, why make it more difficult than it has to be? Does Symantec as a CA offer up extra benefits that no other CA has such that it makes sense to "train" web visitors to switch browsers? Of the millions of non-geeks that use Android phones, what % download and use Firefox instead of the default Chrome browser?
- gcp 10y ago
  This line of reasoning works for banks or commercial entities. But note, it does not work for governments. They can, and will, put up a red banner instructing the user to install another browser (or in case of Firefox 52, explain how to disable updates so you can keep using NPAPI plugins).
  - jasode 10y ago
    Interesting point. I spot checked CAs for some of the most popular USA government websites. irs.gov (Internal Revenue Service): Entrust CA va.gov (Veterans Affairs) : Symantec CA So if Symantec is the CA for a critical mass of government websites that won't abandon them, Google Chrome could lose this battle. Without looking at traffic data (e.g Alexa), my intuition says the vast majority of web traffic is not government websites. If Veterans Affairs forces user to switch browsers, I'm guessing people would still use their Chrome browser for all the other websites because that's where all their bookmarks live. As for non-government websites, I notice that Netflix.com currently has a Symantec Class 3 CA. I'm guessing Netflix would rather switch to another CA.
    - gcp 10y ago
      I believe it is actually a matter of political campaigning in South Korea to get rid of ancient IE ActiveX requirements for government websites.
      - rspeer 10y ago
        It's not just government websites, it's requirements that the government placed on all e-commerce sites in South Korea.
    - tialaramex 10y ago
      The US Federal Government has stated a long term plan to operate a CA in the Web PKI, because after all it does operate a whole shitload of web sites, and it has secure buildings and trustworthy employees needed to run the CA. Like some other government-owned CAs it has offered up front to limit its CA to a TLD it controls anyway (in this case gov) so it won't be offering certificates to the general public. They don't have a formal proposal yet, such proposals take anywhere from 6-18 months to process once they come out, and so the IRS or Veterans Affairs won't be getting new certificates from them in 2017, but in 2018 that's definitely a possibility. Of course, a US Federal Government CA in the Web PKI would be problematic for Google, Apple, Microsoft or Mozilla (all US corporations) to distrust later if things go wrong, this is doubtless why they ask to limit to one TLD, defusing concerns in advance...
- caf 10y ago
  Mozilla has also been putting the hard word on Symantec over this issue, I don't think they'll be too far behind Chromium in taking action.
phaed 10y ago
How will these websites communicate #3? Through the blocked website?
- tedunangst 10y ago
  Obviously they get another cert, but only serve it to chrome users via SSL handshake fingerprinting, and serve the Symantec cert to everybody else...
  - wtetzner 10y ago
    I can't tell if you're joking. Just in case you're not, if they went through all the trouble to get another cert for Chrome, why wouldn't they just use it for everyone?
    - agwa 10y ago
      I suspect it was a joke, but you raise a very important question. Unfortunately, some clients (likely embedded devices) trust only Symantec roots, since that's the CA the website was using at the time the developer slapped together their code.
- CountSessine 10y ago
  Wouldn't they just do what all browser-version-specific websites have done in the past and have an http landing page with a conditional redirect? User agent is IE6, and you progress to ie6.bankofamerica.com. User agent is Chrome/Firefox, progress to webpage with browser version warning and download link for IE6.
  - tedunangst 10y ago
    Maybe after their HSTS header expires. What do they do until then? Or for all the users with https bookmarks?
    - CountSessine 10y ago

jasode 10y ago

>Large websites using Symantec certs start telling users Chrome is "broken" I'm having a hard time thinking of a scenario where a large website concludes it's cheaper to convince web shoppers at ecommerce sites and web visitors at news sites to switch to Firefox/IE instead of the website just switching CA vendors. If you're a website that wants to put up zero friction between buyers submitting their credit-card info and pay you money, why try to "educate" them? If you're a website that wants visitors to see your ads next to your journalists' stories, why make it more difficult than it has to be? Does Symantec as a CA offer up extra benefits that no other CA has such that it makes sense to "train" web visitors to switch browsers? Of the millions of non-geeks that use Android phones, what % download and use Firefox instead of the default Chrome browser?

gcp 10y ago
This line of reasoning works for banks or commercial entities. But note, it does not work for governments. They can, and will, put up a red banner instructing the user to install another browser (or in case of Firefox 52, explain how to disable updates so you can keep using NPAPI plugins).
- jasode 10y ago
  Interesting point. I spot checked CAs for some of the most popular USA government websites. irs.gov (Internal Revenue Service): Entrust CA va.gov (Veterans Affairs) : Symantec CA So if Symantec is the CA for a critical mass of government websites that won't abandon them, Google Chrome could lose this battle. Without looking at traffic data (e.g Alexa), my intuition says the vast majority of web traffic is not government websites. If Veterans Affairs forces user to switch browsers, I'm guessing people would still use their Chrome browser for all the other websites because that's where all their bookmarks live. As for non-government websites, I notice that Netflix.com currently has a Symantec Class 3 CA. I'm guessing Netflix would rather switch to another CA.
  - gcp 10y ago
    I believe it is actually a matter of political campaigning in South Korea to get rid of ancient IE ActiveX requirements for government websites.
    - rspeer 10y ago
      It's not just government websites, it's requirements that the government placed on all e-commerce sites in South Korea.
  - tialaramex 10y ago
    The US Federal Government has stated a long term plan to operate a CA in the Web PKI, because after all it does operate a whole shitload of web sites, and it has secure buildings and trustworthy employees needed to run the CA. Like some other government-owned CAs it has offered up front to limit its CA to a TLD it controls anyway (in this case gov) so it won't be offering certificates to the general public. They don't have a formal proposal yet, such proposals take anywhere from 6-18 months to process once they come out, and so the IRS or Veterans Affairs won't be getting new certificates from them in 2017, but in 2018 that's definitely a possibility. Of course, a US Federal Government CA in the Web PKI would be problematic for Google, Apple, Microsoft or Mozilla (all US corporations) to distrust later if things go wrong, this is doubtless why they ask to limit to one TLD, defusing concerns in advance...
caf 10y ago
Mozilla has also been putting the hard word on Symantec over this issue, I don't think they'll be too far behind Chromium in taking action.

phaed 10y ago

How will these websites communicate #3? Through the blocked website?

tedunangst 10y ago
Obviously they get another cert, but only serve it to chrome users via SSL handshake fingerprinting, and serve the Symantec cert to everybody else...
- wtetzner 10y ago
  I can't tell if you're joking. Just in case you're not, if they went through all the trouble to get another cert for Chrome, why wouldn't they just use it for everyone?
  - agwa 10y ago
    I suspect it was a joke, but you raise a very important question. Unfortunately, some clients (likely embedded devices) trust only Symantec roots, since that's the CA the website was using at the time the developer slapped together their code.
CountSessine 10y ago
Wouldn't they just do what all browser-version-specific websites have done in the past and have an http landing page with a conditional redirect? User agent is IE6, and you progress to ie6.bankofamerica.com. User agent is Chrome/Firefox, progress to webpage with browser version warning and download link for IE6.
- tedunangst 10y ago
  Maybe after their HSTS header expires. What do they do until then? Or for all the users with https bookmarks?
  - CountSessine 10y ago