5 ms·
Not instantly, because google.com's glue records have a 2-day TTL. Verisign has the ability to alter DNS glue records for .com and they have the ability to iss
by harshreality 15y ago
Not instantly, because google.com's glue records have a 2-day TTL.
Verisign has the ability to alter DNS glue records for .com and they have the ability to issue browser-trusted certificates, except in cases of browser cert pinning functionality or extensions (like CertPatrol) that check for certs being altered before they're nearly expired.
Registrars can instruct Verisign to alter the glue records for .com domains. Are you saying Verisign has special policies in place to double check with major companies before changing their respective glue records?
- ynniv 15y agoDo any browsers pin certs by default? I haven't heard of CertPatrol, but alerting when a cert changes well before expiration seems like good default.
- harshreality 15y agoChrome has certain google.com certificates (maybe all of them) pinned. {accounts, mail, docs}.google.com (at least) have HSTS forced and preloaded in Chrome, but www.google.com does not.
- cleverjake 15y agoI'd love to see where you found this information. I wasn't able to find it in Chrome's source, but I didn't have the change to do a deep dive.
- harshreality 14y agohttp://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html http://blog.chromium.org/2011/06/new-chromium-security-features-june.html http://blog.chromium.org/2011/06/new-chromium-security-featu... as well as empirical Chrome behavior.