5 ms·

I have a free SHA-1 signed cert from StartSSL that only expires in June 2015. The rest of the chain is SHA-256 signed (at least this is what Chrome tells me). W

by gbl08ma 12y ago

I have a free SHA-1 signed cert from StartSSL that only expires in June 2015. The rest of the chain is SHA-256 signed (at least this is what Chrome tells me). Will a cert in these conditions start showing a red lock with the next version of Chrome? If yes, is there a way I can reissue the StartSSL certificate with SHA-256 signing, without having to pay? A quick Google search tells me there isn't. I'm anxiously waiting for Let's Encrypt to launch, as StartCom is kinda shady with the free cert thing (remember what happened with Heartbleed WRT revoking?). Until then, I begin to wonder if it wouldn't be best to (ugh) disable HTTPS for Chrome 42+ users, since most people will perceive a red lock thing on their status bar as "less secure" than the "silently gray" HTTP (even if technically, that's obviously not the case). If Google decides SHA-1 is so bad that it deserves being visibly marked as insecure, then why don't they also show a red cross on HTTP sites? EDIT: oops, missed the "valid past 2015" part. My question is still valid, isn't insecure HTTP more deserving of a red cross than SHA-1 certs that expire in, say, 2016?

rgbrenner 12y ago
certs that expire before jan 1 2016 are unaffected. And there is a proposal to mark all http traffic as insecure also: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http...
MichaelGG 12y ago
No, because HTTP doesn't imply security, whereas HTTPS does. If someone follows an HTTPS link, then that's an intention for security and should be respected. (Though it's not a bad idea to put some sort is warning indicator on HTTP, just to help reinforce things.)
- marcosdumay 12y ago
  Just when was the last time you typed the "https://" https://" at the address bar of your browser (accessing a site that isn't yours)? People just don't think this way. Well informed people (a small minority) will check the padlock after the site loads. Most people will use an HTTP site thinking it's secure.
vtlynch 12y ago
If they are going to show a green padlock, the connection needs to be reasonably secure, because the icon is supposed to indicate as such. With HTTP there are no icons being shown indicating you are secure, so there should be no expectation of security. Chrome's security team is working on a proposal to show negative UI indicators to sites using HTTP: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http...
- Someone1234 12y ago
  That's always been a massive pet peeve of mine. HTTP gets a "free pass" (white/generic) but if you dare to self sign, BIG RED SCARY ALERT. Yet nobody thinks self-signed is less secure than HTTP, the worst you could claim is "equally as secure" (when the reality is it makes it subtly harder to eavesdrop, but provides no MITM protections at all). They should just give HTTP and self-signed a red bar, and stop with the silly warning pages (unless the site previously had a CA signed certificate and HSTS). Just treat HTTPS self-signed the same as HTTP, that's all I ask.
  - kllrnohj 12y ago
    Well yes, but is it self-signed (or otherwise "invalid" cert) because the user was MITM or because that's what the server handed over? The former really does deserved a BIG RED SCARY ALERT, the later not so much. But distinguishing those two reliably is not feasible, so browsers fail-safe into assuming it's a potential MITM.
    - Someone1234 12y ago
      > Well yes, but is it self-signed (or otherwise "invalid" cert) because the user was MITM or because that's what the server handed over? Is it HTTP because the user was MITM or because that's what the server handed over? Again, why one rule for HTTP and another for self-signed. It is inconsistent. HTTPS sites being hacked and turned into HTTP is a real and common problem, yet where is HTTP's red bar of danger?
rictic 12y ago
> most people will perceive a red lock thing on their status bar as "less secure" than the "silently gray" HTTP (even if technically, that's obviously not the case) This is true. I believe that Chrome is experimenting with marking http as insecure with yellow text.
- qrmn 12y ago
  Red text, with a lock with an X next to it - at least, that's what's checked in at the moment.

by gbl08ma 12y ago

rgbrenner 12y ago

certs that expire before jan 1 2016 are unaffected. And there is a proposal to mark all http traffic as insecure also: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http...

MichaelGG 12y ago

No, because HTTP doesn't imply security, whereas HTTPS does. If someone follows an HTTPS link, then that's an intention for security and should be respected. (Though it's not a bad idea to put some sort is warning indicator on HTTP, just to help reinforce things.)

marcosdumay 12y ago
Just when was the last time you typed the "https://" https://" at the address bar of your browser (accessing a site that isn't yours)? People just don't think this way. Well informed people (a small minority) will check the padlock after the site loads. Most people will use an HTTP site thinking it's secure.

vtlynch 12y ago

If they are going to show a green padlock, the connection needs to be reasonably secure, because the icon is supposed to indicate as such. With HTTP there are no icons being shown indicating you are secure, so there should be no expectation of security. Chrome's security team is working on a proposal to show negative UI indicators to sites using HTTP: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http...

Someone1234 12y ago
That's always been a massive pet peeve of mine. HTTP gets a "free pass" (white/generic) but if you dare to self sign, BIG RED SCARY ALERT. Yet nobody thinks self-signed is less secure than HTTP, the worst you could claim is "equally as secure" (when the reality is it makes it subtly harder to eavesdrop, but provides no MITM protections at all). They should just give HTTP and self-signed a red bar, and stop with the silly warning pages (unless the site previously had a CA signed certificate and HSTS). Just treat HTTPS self-signed the same as HTTP, that's all I ask.
- kllrnohj 12y ago
  Well yes, but is it self-signed (or otherwise "invalid" cert) because the user was MITM or because that's what the server handed over? The former really does deserved a BIG RED SCARY ALERT, the later not so much. But distinguishing those two reliably is not feasible, so browsers fail-safe into assuming it's a potential MITM.
  - Someone1234 12y ago
    > Well yes, but is it self-signed (or otherwise "invalid" cert) because the user was MITM or because that's what the server handed over? Is it HTTP because the user was MITM or because that's what the server handed over? Again, why one rule for HTTP and another for self-signed. It is inconsistent. HTTPS sites being hacked and turned into HTTP is a real and common problem, yet where is HTTP's red bar of danger?

rictic 12y ago

> most people will perceive a red lock thing on their status bar as "less secure" than the "silently gray" HTTP (even if technically, that's obviously not the case) This is true. I believe that Chrome is experimenting with marking http as insecure with yellow text.

qrmn 12y ago
Red text, with a lock with an X next to it - at least, that's what's checked in at the moment.