3 ms·
Wow, the security features Chrome used to nullify the attack were just implemented in June. I wonder if that was a reaction to another incident like this, or if
by artursapek 15y ago
Wow, the security features Chrome used to nullify the attack were just implemented in June. I wonder if that was a reaction to another incident like this, or if it was just good foresight?
- tptacek 15y agoThey ship one of the Big 4 browsers and run the Internet's most popular mail server (and thus biggest TLS target). They're uniquely poised to do things like this.
- waitwhat 15y agothe Internet's most popular mail server It is my understanding that gmail is dwarfed by both Hotmail and Yahoo! Mail.
- Natsu 15y agoThis isn't the first time something like this has happened. I don't know if they did it in response to any one particular incident, but they have every reason in the world to implement something like that.
- mukyu 15y agohttp://blog.chromium.org/2011/06/new-chromium-security-features-june.html http://blog.chromium.org/2011/06/new-chromium-security-featu... > In addition in Chromium 13, only a very small subset of CAs have the authority to vouch for Gmail (and the Google Accounts login page). This can protect against recent incidents[1][2] where a CA has its authority abused, and generally protects against the proliferation of signing authority. [1] http://googleonlinesecurity.blogspot.com/2011/04/improving-ssl-certificate-security.html http://googleonlinesecurity.blogspot.com/2011/04/improving-s... [2] http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html