3 ms·

> While all major CAs have experienced SSL/TLS certificate mis-issuance events, Google has singled out the Symantec Certificate Authority in its proposal even t

> While all major CAs have experienced SSL/TLS certificate mis-issuance events, Google has singled out the Symantec Certificate Authority in its proposal even though the mis-issuance event identified in Google’s blog post involved several CAs. "We are not the only one doing this, why us Google, why us?" What a shitty excuse. Laughable. Big F to Symantec and wish you bankrupt :)

tajen 10y ago
I wish Google were more serious. A proof of deceptive falsification of certificates by a CA should lead to an immediate distrust in browsers, period. The job is on the side of CA companies to run audits at the extent of possible damages, just like in nuclear plants: You just can't do a mistake, and certainly not 127.
- scrollaway 10y ago
  So chrome can no longer browse ~30% of the secured web. People instead install a different browser that isn't so "serious", as you put it. Oh and the message that sends to website owners? "Just don't use HTTPS, your SSL certificate could be invalidated with no prior warning for reasons that have nothing to do with you". Easy, right? Just like a nuclear plant.
  - tajen 10y ago
    I don't know, what's best for security? The message is don't use a dodgy provider. Yes it's a pain for customers, but don't forget we're mostly talking about level 2/3 certificates (EV, wildcards), so we're talking about banks and major companies here. They both should and have enough resources to monitor the trustworthiness of their providers. In the current case, Symantec's falsifications has been know for long enough.
    - cryptarch 10y ago
      I do think the "drop it like it's hot" approach could work, but it would require browser vendor coordination, so that Symantic https stops working on all major browsers at the same time/day. And honestly, banks should have the expertise and resources to change certs in a day or two, and if they don't that's on them.

tajen 10y ago

I wish Google were more serious. A proof of deceptive falsification of certificates by a CA should lead to an immediate distrust in browsers, period. The job is on the side of CA companies to run audits at the extent of possible damages, just like in nuclear plants: You just can't do a mistake, and certainly not 127.

scrollaway 10y ago
So chrome can no longer browse ~30% of the secured web. People instead install a different browser that isn't so "serious", as you put it. Oh and the message that sends to website owners? "Just don't use HTTPS, your SSL certificate could be invalidated with no prior warning for reasons that have nothing to do with you". Easy, right? Just like a nuclear plant.
- tajen 10y ago
  I don't know, what's best for security? The message is don't use a dodgy provider. Yes it's a pain for customers, but don't forget we're mostly talking about level 2/3 certificates (EV, wildcards), so we're talking about banks and major companies here. They both should and have enough resources to monitor the trustworthiness of their providers. In the current case, Symantec's falsifications has been know for long enough.
  - cryptarch 10y ago
    I do think the "drop it like it's hot" approach could work, but it would require browser vendor coordination, so that Symantic https stops working on all major browsers at the same time/day. And honestly, banks should have the expertise and resources to change certs in a day or two, and if they don't that's on them.