14 ms·

The fact that I have to open developer tools to inspect the cert on Chrome is infuriating.

by inetknght 10y ago

deleted 10y ago
[deleted]
AcerbicZero 10y ago
It was one of those minor chrome changes that shouldn't bother me, but ends up driving me slightly insane.
- inetknght 10y ago
  The dumbing down of Chrome is seriously driving me away. There used to be a ton of power-user-friendly options easily available. Now they're all hidden in favor of simplicity. My brother's been recommending Opera for a long time. I think it's time I listened to him and gave it a try.
  - problems 10y ago
    There's a big difference in attitudes between browsers here. Take OCSP for example - Chrome disabled OCSP because in optional mode it wasn't a perfect solution and they didn't want to enable it in required mode because that could confuse the poor users. After the heartbleed attack, Chrome was only able to bundle a tiny fraction of the certificates into their CRLs - leaving millions of domains still vulnerable to blacklisted certificates. On Chrome - you're just screwed, there's no way to turn OCSP into required mode to prevent such attacks. On Firefox however you're able to force OCSP required - making it actually useful if you're sophisticated enough to understand what a failure of it may mean and you're actually able to blacklist all of those certificates. A huge security benefit in such a case.
    - wfunction 10y ago
      Edit: I'm wrong. Removing this comment regarding why certificate revocation checking is still useful, because someone pointed out you can create a new account to get a new certificate from a CA, and I didn't realize it was that easy to just sign up for a new account. (I was thinking of EV certificates mostly so I didn't think of this attack vector at all.) See [1] for background. Thanks all for pointing that out. [1] https://www.imperialviolet.org/2014/04/19/revchecking.html https://www.imperialviolet.org/2014/04/19/revchecking.html
      - problems 10y ago
        I think he's actually right about the attacker being near you most of the time - compromising a data center is much harder than compromising a LAN most of the time. However, he completely ignores the fact that some users may be sophisticated enough the handle the hard-fail scenarios mentioned. Well, I am. And so are many others. So what am I supposed to do if I want security and can handle hard-fails? Not use Chrome seems to be the answer. Chrome fails to account for power users and developers who would rather have improved security and functionality.
        tptacek 10y ago
        What's your alternative? A customized Chromium fork? Every other browser is markedly less secure than Chrome. If exploit resilience is all you care about, you can theoretically use Edge, but now you're throwing away a lot of important TLS policy stuff that Chrome does and Microsoft is years behind on.
        problems 10y ago
        Firefox - they're years ahead on this sort of stuff. Their about:config gives you immense power to configure your browser to behave exactly how you want it to. Unlike any other browser around really. The flexibility this brings you in privacy gains alone is immense. Just try to do something as basic as turn off WebRTC in Chrome and you'll see what I'm talking about. Firefox is the only viable answer if you care about privacy and security and have the ability to take things into your own hands.
        tptacek 10y ago
        Virtually nobody who works in browser security agrees with you about that. There are privacy wins to be had with Firefox, but they come at the expense of security.
        problems 10y ago
        That's a pretty big claim, one which I'm guessing you're offering absolutely no evidence to back up?
    - tptacek 10y ago
      Without widespread adoption of a must-staple extension, OCSP is cosmetic. The decision to disable it didn't come from simplicity fascists; it came from people like Adam Langley. AGL isn't right about everything, but if you take the position that something he does with Chrome TLS is ludicrous, my default will be that you don't understand the issue as well as he does.
      - problems 10y ago
        > Without widespread adoption of a must-staple extension, OCSP is cosmetic. The decision to disable it didn't come from simplicity fascists; it came from people like Adam Langley. AGL isn't right about everything, but if you take the position that something he does with Chrome TLS is ludicrous, my default will be that you don't understand the issue as well as he does. Well, please, do explain where I'm mistaken here - is OCSP required not the most secure option? And it was rejected simply due to usability reasons on Chrome? And the option to do so anyways for power users doesn't exist because Chrome is a browser for ease of use? I'm not saying it's entirely ludicrous - for a good chunk of the user base CRLs are at least decent - but having an option for power users who desire more security should be available. And it's mandatory for any browser that wants to be used by power users. Stop with the appeals to authority and make an actual argument if you disagree.
        tptacek 10y ago
        I don't understand the questions you're asking here, but, no, OCSP wasn't disabled simply due to usability reasons, but rather because it did not work.
        problems 10y ago
        It works just fine if you require an OCSP response and hardfail. Soft-failing is for usability and it's the cause of the problem. Yes, must-staple is the optimal solution, but OCSP required is the best available today. Look at some of the numbers here: https://www.grc.com/revocation/crlsets.htm https://www.grc.com/revocation/crlsets.htm
  - xtracto 10y ago
    Interesting assertion. Back in 2008 when Chrome was released, that was exactly the same feeling people had about it. I remember some of us where sad to see the search bar and address bar combined, along with other stuff that Firefox, Explorer and other browsers had. If I remember correctly, one of Chrome's objectives since the beginning has been to remove a lot of functionality and clutter (o yeah, the menu bar was another thing that Chrome did not have and drove some people crazy).
mox1 10y ago
+1 Vote for them to revert it here: https://bugs.chromium.org/p/chromium/issues/detail?id=663971 https://bugs.chromium.org/p/chromium/issues/detail?id=663971
atmosx 10y ago
I open Safari just for that... It wasn't like that a few versions back.
- Dylan16807 10y ago
  You open a different browser to save one button press?
  - ktta 10y ago
    It isn't a single button press. Right-click -> inspect -> Security -> View Certificate. Although I have to agree opening a new browser for checking a certificate is hilarious.
    - phit_ 10y ago
      F12 > View Certificate well at least if you have had selected Security in the dev tools last
      - Chlorus 10y ago
        On macOS, it's the "intuitive" command + option + i , which I can never remember (and then you still have to click on the stupid security tab, which is hidden if you don't have enough horizontal space on the dev tool frame)
        ktta 10y ago
        It is much worse than the previously convenient click-on-lock-icon -> view certificate. Even on windows, F12 is usually a Fn key, so I have to select Fn+F12 which I never knew till the GP pointed it out to me.
zip1234 10y ago
Why would they even change that?
problems 10y ago
I'm reminded of a Torvalds quote from about a decade ago: > This 'users are idiots, and are confused by functionality' mentality of Gnome is a disease. If you think your users are idiots, only idiots will use it.
- ajross 10y ago
  For clarity, the feature isn't removed. You open the developer console (it has like nine keys bound to do this, F12 is the easiest), select the "security" tab, then hit the "view certificate" button. I buy that this isn't as easy as the old mechanism (click on the TLS lock icon next to the URL) but...
  - pasbesoin 10y ago
    But the point was/is to get "normal" users to pay attention. This just buries those details further away. In the last few years, I've been somewhat pleasantly surprised at how much more attention my non-tech friends and acquaintances are paying to the topic of security. No, they don't have it all figured out. But they are aware, and they are demonstrating some "pause and check". How nice it would be to be able to point them to an obvious and straight-forward representation/presentation of the cert chain. Instead, we get continued fussing with the "lock UI" and further and further hiding away of the relevant details. Boo.
  - mpclark 10y ago
    Didn't know about F12 - thanks for the tip!
  - aargh_aargh 10y ago
    What are the other keys? I know about F12, but I have it mapped to something else. I'm using Gnome.
    - ajross 10y ago
      Any of Ctrl-Shift-{c,i,j} will pop up various tabs of the developer tools. There may be others I'm not aware of.
dunham 10y ago
Yes, it is infuriating. I didn't even realize it was in the dev tools until today. I thought they'd just dropped the functionality altogether. The dev tools are nice, and I like using the multiple profiles for both dev (logging in as multiple users) and segregating my banking cookies. Otherwise I'd drop chrome for safari. (I also wish they'd expose certificate metadata to plugins, so I could write my own cert checking/pinning code.)

The fact that I have to open developer tools to inspect the cert on Chrome is infuriating.

deleted 10y ago

[deleted]

AcerbicZero 10y ago

It was one of those minor chrome changes that shouldn't bother me, but ends up driving me slightly insane.

inetknght 10y ago
The dumbing down of Chrome is seriously driving me away. There used to be a ton of power-user-friendly options easily available. Now they're all hidden in favor of simplicity. My brother's been recommending Opera for a long time. I think it's time I listened to him and gave it a try.
- problems 10y ago
  There's a big difference in attitudes between browsers here. Take OCSP for example - Chrome disabled OCSP because in optional mode it wasn't a perfect solution and they didn't want to enable it in required mode because that could confuse the poor users. After the heartbleed attack, Chrome was only able to bundle a tiny fraction of the certificates into their CRLs - leaving millions of domains still vulnerable to blacklisted certificates. On Chrome - you're just screwed, there's no way to turn OCSP into required mode to prevent such attacks. On Firefox however you're able to force OCSP required - making it actually useful if you're sophisticated enough to understand what a failure of it may mean and you're actually able to blacklist all of those certificates. A huge security benefit in such a case.
  - wfunction 10y ago
    Edit: I'm wrong. Removing this comment regarding why certificate revocation checking is still useful, because someone pointed out you can create a new account to get a new certificate from a CA, and I didn't realize it was that easy to just sign up for a new account. (I was thinking of EV certificates mostly so I didn't think of this attack vector at all.) See [1] for background. Thanks all for pointing that out. [1] https://www.imperialviolet.org/2014/04/19/revchecking.html https://www.imperialviolet.org/2014/04/19/revchecking.html
    - problems 10y ago
      I think he's actually right about the attacker being near you most of the time - compromising a data center is much harder than compromising a LAN most of the time. However, he completely ignores the fact that some users may be sophisticated enough the handle the hard-fail scenarios mentioned. Well, I am. And so are many others. So what am I supposed to do if I want security and can handle hard-fails? Not use Chrome seems to be the answer. Chrome fails to account for power users and developers who would rather have improved security and functionality.
      - tptacek 10y ago
        What's your alternative? A customized Chromium fork? Every other browser is markedly less secure than Chrome. If exploit resilience is all you care about, you can theoretically use Edge, but now you're throwing away a lot of important TLS policy stuff that Chrome does and Microsoft is years behind on.
        problems 10y ago
        Firefox - they're years ahead on this sort of stuff. Their about:config gives you immense power to configure your browser to behave exactly how you want it to. Unlike any other browser around really. The flexibility this brings you in privacy gains alone is immense. Just try to do something as basic as turn off WebRTC in Chrome and you'll see what I'm talking about. Firefox is the only viable answer if you care about privacy and security and have the ability to take things into your own hands.
        tptacek 10y ago
        Virtually nobody who works in browser security agrees with you about that. There are privacy wins to be had with Firefox, but they come at the expense of security.
        problems 10y ago
        That's a pretty big claim, one which I'm guessing you're offering absolutely no evidence to back up?
  - tptacek 10y ago
    Without widespread adoption of a must-staple extension, OCSP is cosmetic. The decision to disable it didn't come from simplicity fascists; it came from people like Adam Langley. AGL isn't right about everything, but if you take the position that something he does with Chrome TLS is ludicrous, my default will be that you don't understand the issue as well as he does.
    - problems 10y ago
      > Without widespread adoption of a must-staple extension, OCSP is cosmetic. The decision to disable it didn't come from simplicity fascists; it came from people like Adam Langley. AGL isn't right about everything, but if you take the position that something he does with Chrome TLS is ludicrous, my default will be that you don't understand the issue as well as he does. Well, please, do explain where I'm mistaken here - is OCSP required not the most secure option? And it was rejected simply due to usability reasons on Chrome? And the option to do so anyways for power users doesn't exist because Chrome is a browser for ease of use? I'm not saying it's entirely ludicrous - for a good chunk of the user base CRLs are at least decent - but having an option for power users who desire more security should be available. And it's mandatory for any browser that wants to be used by power users. Stop with the appeals to authority and make an actual argument if you disagree.
      - tptacek 10y ago
        I don't understand the questions you're asking here, but, no, OCSP wasn't disabled simply due to usability reasons, but rather because it did not work.
        problems 10y ago
        It works just fine if you require an OCSP response and hardfail. Soft-failing is for usability and it's the cause of the problem. Yes, must-staple is the optimal solution, but OCSP required is the best available today. Look at some of the numbers here: https://www.grc.com/revocation/crlsets.htm https://www.grc.com/revocation/crlsets.htm
- xtracto 10y ago
  Interesting assertion. Back in 2008 when Chrome was released, that was exactly the same feeling people had about it. I remember some of us where sad to see the search bar and address bar combined, along with other stuff that Firefox, Explorer and other browsers had. If I remember correctly, one of Chrome's objectives since the beginning has been to remove a lot of functionality and clutter (o yeah, the menu bar was another thing that Chrome did not have and drove some people crazy).

mox1 10y ago

+1 Vote for them to revert it here: https://bugs.chromium.org/p/chromium/issues/detail?id=663971 https://bugs.chromium.org/p/chromium/issues/detail?id=663971

atmosx 10y ago

I open Safari just for that... It wasn't like that a few versions back.

Dylan16807 10y ago
You open a different browser to save one button press?
- ktta 10y ago
  It isn't a single button press. Right-click -> inspect -> Security -> View Certificate. Although I have to agree opening a new browser for checking a certificate is hilarious.
  - phit_ 10y ago
    F12 > View Certificate well at least if you have had selected Security in the dev tools last
    - Chlorus 10y ago
      On macOS, it's the "intuitive" command + option + i , which I can never remember (and then you still have to click on the stupid security tab, which is hidden if you don't have enough horizontal space on the dev tool frame)
      - ktta 10y ago
        It is much worse than the previously convenient click-on-lock-icon -> view certificate. Even on windows, F12 is usually a Fn key, so I have to select Fn+F12 which I never knew till the GP pointed it out to me.

zip1234 10y ago

Why would they even change that?

problems 10y ago

I'm reminded of a Torvalds quote from about a decade ago: > This 'users are idiots, and are confused by functionality' mentality of Gnome is a disease. If you think your users are idiots, only idiots will use it.

ajross 10y ago
For clarity, the feature isn't removed. You open the developer console (it has like nine keys bound to do this, F12 is the easiest), select the "security" tab, then hit the "view certificate" button. I buy that this isn't as easy as the old mechanism (click on the TLS lock icon next to the URL) but...
- pasbesoin 10y ago
  But the point was/is to get "normal" users to pay attention. This just buries those details further away. In the last few years, I've been somewhat pleasantly surprised at how much more attention my non-tech friends and acquaintances are paying to the topic of security. No, they don't have it all figured out. But they are aware, and they are demonstrating some "pause and check". How nice it would be to be able to point them to an obvious and straight-forward representation/presentation of the cert chain. Instead, we get continued fussing with the "lock UI" and further and further hiding away of the relevant details. Boo.
- mpclark 10y ago
  Didn't know about F12 - thanks for the tip!
- aargh_aargh 10y ago
  What are the other keys? I know about F12, but I have it mapped to something else. I'm using Gnome.
  - ajross 10y ago
    Any of Ctrl-Shift-{c,i,j} will pop up various tabs of the developer tools. There may be others I'm not aware of.

dunham 10y ago

Yes, it is infuriating. I didn't even realize it was in the dev tools until today. I thought they'd just dropped the functionality altogether. The dev tools are nice, and I like using the multiple profiles for both dev (logging in as multiple users) and segregating my banking cookies. Otherwise I'd drop chrome for safari. (I also wish they'd expose certificate metadata to plugins, so I could write my own cert checking/pinning code.)