6 ms·

Training users to ignore SSL warnings. sigh

by omeid2 12y ago

quonn 12y ago
I think Chrome only shows the red sign in the address bar, not the usual warning page. This step was announced some time ago, and since certificates usually need to be replaced frequently, there should be very few problematic certificates, if the CAs did their job.
- omeid2 12y ago
  It is still bad. Most users don't understand the difference. And the "in for a penny, in for a pound" mentality is more common than one would hope.
- josteink 12y ago
  > This step was announced some time ago, and since certificates usually need to be replaced frequently Most people will buy certs valid for a few years, or around a couple of dozen Chrome-releases, and forget about them until they expire. From my experience, among the things deployed in the world of IT, I would argue they are among the things replaced most infrequently. So I'm curious... What makes you say certificates needs to be replaced frequently? What's the use-cases you are referring to?
  - helyka 12y ago
    That being said. How can I check our cert? The current cert predates my employment with the county and this is something I have never had to deal with.
    - grhino 12y ago
      If you view your website in chrome, you can click on the lock icon in the address bar. Go to the connection tab -> Click certificate information -> Details Tab. You should see one of the entries should be signature algorithm. SHA-1 is a problem. SHA-224 or higher means the cert is on SHA-2 which is okay.
    - jamies888888 12y ago
      This is a quick check site I've used previously: https://shaaaaaaaaaaaaa.com/ https://shaaaaaaaaaaaaa.com/ However the proper test should be done using https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/
    - marcosdumay 12y ago
      If you are in Firefox, you can also click the padlock icon, and click on the more information button.
  - smackfu 12y ago
    Yeah, *.ycombinator.com is using a 5-year certificate which was issued in 2014.
- geofft 12y ago
  Yes, that's correct. Due to a subtle bug (https://crbug.com/472978 https://crbug.com/472978), my beta-channel Chromebook thinks my personal website has a SHA-1 intermediate, so I've seen this happen. There's no certificate warning / interstitial, just the red slash through the "https".
- crucialfelix 12y ago
  It looks pretty bad and alarming. I'm on canary, so I've seen the warning on my own site. With only a weeks warning I have to get this solved before normal customers start seeing it. A big nasty red strike through our reputation. > there should be very few problematic certificates, if the CAs did their job. The cert was bought through Network Solutions in the past year. They are not exactly amateurs. I've already had to spend 45 minutes researching and trying to solve this and I still have to waste more time resolving this.

Training users to ignore SSL warnings. sigh

by omeid2 12y ago

Training users to ignore SSL warnings. sigh

quonn 12y ago

I think Chrome only shows the red sign in the address bar, not the usual warning page. This step was announced some time ago, and since certificates usually need to be replaced frequently, there should be very few problematic certificates, if the CAs did their job.

omeid2 12y ago
It is still bad. Most users don't understand the difference. And the "in for a penny, in for a pound" mentality is more common than one would hope.
josteink 12y ago
> This step was announced some time ago, and since certificates usually need to be replaced frequently Most people will buy certs valid for a few years, or around a couple of dozen Chrome-releases, and forget about them until they expire. From my experience, among the things deployed in the world of IT, I would argue they are among the things replaced most infrequently. So I'm curious... What makes you say certificates needs to be replaced frequently? What's the use-cases you are referring to?
- helyka 12y ago
  That being said. How can I check our cert? The current cert predates my employment with the county and this is something I have never had to deal with.
  - grhino 12y ago
    If you view your website in chrome, you can click on the lock icon in the address bar. Go to the connection tab -> Click certificate information -> Details Tab. You should see one of the entries should be signature algorithm. SHA-1 is a problem. SHA-224 or higher means the cert is on SHA-2 which is okay.
  - jamies888888 12y ago
    This is a quick check site I've used previously: https://shaaaaaaaaaaaaa.com/ https://shaaaaaaaaaaaaa.com/ However the proper test should be done using https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/
  - marcosdumay 12y ago
    If you are in Firefox, you can also click the padlock icon, and click on the more information button.
- smackfu 12y ago
  Yeah, *.ycombinator.com is using a 5-year certificate which was issued in 2014.
geofft 12y ago
Yes, that's correct. Due to a subtle bug (https://crbug.com/472978 https://crbug.com/472978), my beta-channel Chromebook thinks my personal website has a SHA-1 intermediate, so I've seen this happen. There's no certificate warning / interstitial, just the red slash through the "https".
crucialfelix 12y ago
It looks pretty bad and alarming. I'm on canary, so I've seen the warning on my own site. With only a weeks warning I have to get this solved before normal customers start seeing it. A big nasty red strike through our reputation. > there should be very few problematic certificates, if the CAs did their job. The cert was bought through Network Solutions in the past year. They are not exactly amateurs. I've already had to spend 45 minutes researching and trying to solve this and I still have to waste more time resolving this.