3 ms·

This actually shouldn't be something that a company that is giving away a product should even be enforcing or deciding on their own. Reason? It makes the assump

by gist 8y ago

This actually shouldn't be something that a company that is giving away a product should even be enforcing or deciding on their own. Reason? It makes the assumption that end users are not willing to accept that in rare cases their traffic can be intercepted and it further assumes that it matters at all if that traffic is even intercepted. And most importantly it fails to recognize the impact of making a unilateral decision like this has on those who are not impacted at all. Like some random small site (not a top 1m site) that is just providing info and now either has to pay someone to fix and/or can't have a visitor to view their site. Even in the case of credit card information (or other sensitive data) I would love to know exactly what the probability is of info being stolen. Not hypothetically. But the actual risk. This idea of 'security at all costs' without looking at the actual cost and/or implementation is not realistic at all and can do more harm (some site not being accessible) than good.

excalibur 8y ago
Let's Encrypt certs are free. Most companies that sold Symantec certs that are being distrusted are offering free replacements. Other trusted certs can be purchased at minimal cost from a variety of vendors. There may be a cost associated with replacing the cert on the server if nobody in your organization has the (very limited) technical skills needed to pull it off yourselves. If you can't deal with a minor IT expenditure with over 6 months' notice, your business has bigger problems.
- gist 8y ago
  Business? Not all websites are for business or run by business people. Yet they provide info on the web. Also Let's Encrypt (I am familiar and we use that btw) is great for certain types of situations but not all situations and doesn't work with all control panels in certain cases. For example using the plesk control panel you can't map a domain to a directory or sub page on a site. You can of course add it as an alias to the main page but not say /thisdirectory/index.html at least not as of last week. Also installing a cert is non-trivial for most users and takes time and work. My issue is not with the people that care to do that or feel it's necessary. It's with this idea that 'everyone should do it period' being decided by the browser vendors. And in particular the way an error message is displayed and shocks a typical user not every gently at all. That is the issue that stops people cold in their track. And scares them.
jeroenhd 8y ago
Browser vendors have previously expressed their trust in the Symantec ecosystem. After Symantec repeatedly failed to hold up their promises, the vendors are now revoking the trust they had placed in Symantec ecosystem. Browser vendors can no longer tell their users they are connecting to a secured and validated website because of this. To accommodate Symantec customers, browser vendors have given people (a lot of) time to change certificates, trusting the certs even though the party that signed them was no longer trusted. This placed users at somewhat of a risk, but made possible a grace period. Now that grace period is nearly over. The companies at fault, who gave out unverifiable certificates, have not contacted all of their customers or their customers have not acted on their messages. Either way, this is not the problem of web browser vendors. End users trust their browsers to warn them if their safe connection is fishy and browsers will soon actually show those warnings. If you disagree and want to ignore the recommendations of Google and Mozilla, feel free to disable the Symantec distrust flag or to use a different browser that still accepts the bad certificates. That is your choice and the choice of any end user. However, those who don't understand the underlying problem continue to rely on the safety their browser software provides, as they should. If a small website can no longer display simple information because of Symantic not being trustworthy, that website should take it up with Symantec. And it's not as if the certificate wouldn't have to be replaced within about a year from now anyway; there's no extra costs or effort required, just earlier costs. Let's not forget that it is the web browsers that gave Symantec a business model to take away in the first place. If from the beginning non-commercial key distributions would have been set up (public keys over DNSSEC or something like that) this would not be a problem and the whole HTTPS certificate market wouldn't even exist. Sure, X509 certificates are used for other usages as well, but not as prominently as for web browsing.

by gist 8y ago

excalibur 8y ago

Let's Encrypt certs are free. Most companies that sold Symantec certs that are being distrusted are offering free replacements. Other trusted certs can be purchased at minimal cost from a variety of vendors. There may be a cost associated with replacing the cert on the server if nobody in your organization has the (very limited) technical skills needed to pull it off yourselves. If you can't deal with a minor IT expenditure with over 6 months' notice, your business has bigger problems.

gist 8y ago
Business? Not all websites are for business or run by business people. Yet they provide info on the web. Also Let's Encrypt (I am familiar and we use that btw) is great for certain types of situations but not all situations and doesn't work with all control panels in certain cases. For example using the plesk control panel you can't map a domain to a directory or sub page on a site. You can of course add it as an alias to the main page but not say /thisdirectory/index.html at least not as of last week. Also installing a cert is non-trivial for most users and takes time and work. My issue is not with the people that care to do that or feel it's necessary. It's with this idea that 'everyone should do it period' being decided by the browser vendors. And in particular the way an error message is displayed and shocks a typical user not every gently at all. That is the issue that stops people cold in their track. And scares them.

jeroenhd 8y ago

Browser vendors have previously expressed their trust in the Symantec ecosystem. After Symantec repeatedly failed to hold up their promises, the vendors are now revoking the trust they had placed in Symantec ecosystem. Browser vendors can no longer tell their users they are connecting to a secured and validated website because of this. To accommodate Symantec customers, browser vendors have given people (a lot of) time to change certificates, trusting the certs even though the party that signed them was no longer trusted. This placed users at somewhat of a risk, but made possible a grace period. Now that grace period is nearly over. The companies at fault, who gave out unverifiable certificates, have not contacted all of their customers or their customers have not acted on their messages. Either way, this is not the problem of web browser vendors. End users trust their browsers to warn them if their safe connection is fishy and browsers will soon actually show those warnings. If you disagree and want to ignore the recommendations of Google and Mozilla, feel free to disable the Symantec distrust flag or to use a different browser that still accepts the bad certificates. That is your choice and the choice of any end user. However, those who don't understand the underlying problem continue to rely on the safety their browser software provides, as they should. If a small website can no longer display simple information because of Symantic not being trustworthy, that website should take it up with Symantec. And it's not as if the certificate wouldn't have to be replaced within about a year from now anyway; there's no extra costs or effort required, just earlier costs. Let's not forget that it is the web browsers that gave Symantec a business model to take away in the first place. If from the beginning non-commercial key distributions would have been set up (public keys over DNSSEC or something like that) this would not be a problem and the whole HTTPS certificate market wouldn't even exist. Sure, X509 certificates are used for other usages as well, but not as prominently as for web browsing.