Hacker News Reader

Comment by tyingq | Hacker News Reader

I don't think Google was soliciting for a counter proposal from Symantec. Will be interesting to see their reply, and whether it's a literal reply or just a version push of chrome with their original plan.[1]

[1] https://groups.google.com/a/chromium.org/forum/m/#!topic/bli...

Edit: They did ask for community feedback, comments on risk, etc. But they do already have a timeline. See link above.

View on HN

"This site does not support Chrome. Please use a browser that does not take unilateral CA authority action." might very well be the response of orgs married to Symantec.

As a user, you need your bank (or other large org) more than you need your preference of browser.

Bold move though, when the fix is just buying a new cert. And the browser you're blocking has majority market share.

"Buying" as if Let's Encrypt isn't a thing. ;-)

well, for any organization that is doing serious ecommerce these days, you would want an EV SSL cert. Which is about $95/year from namecheap or a competitor. The GUI advantages for ordinary totally ignorant end users of seeing the happy green bar at the top are enough to justify the less than $10 per month ongoing cost.

In this context, I assume we're talking about EV certs. Though LE might be an emergency temp option for the big customers that forgot to plan around this.

If you think Let's Encrypt is an acceptable solution for all the affected organizations, you know very little about the state of browser certificates.

Or they see through it.

It really, really doesn't matter if a Hacker News poster "sees through it". It matters that the rest of the world cares.

Technically-correct well-actuallys lose to real-world perception ninety-nine percent of the time.

> If you think Let's Encrypt is an acceptable solution for all the affected organizations,

I think the world is changing in ways which may cause the affected organizations to reconsider what they consider an acceptable CA solution.

Certificate pinning means it's a hell of a lot more than just "buying a new cert".

Ah, yes. If you didn't have a backup cert from another provider and missed your 60 day window. But what was your plan for any other incident that required revocation? I assume anyone turning on pinning hand wrings over it for a while first.

You can pin to the CA intermediate cert, which means revocation isn't a problem as long as you keep the same CA.

Finally, there's some value in, and a reason to, picking a responsible CA instead of the cheapest or most convenient one!

That's the problem, a lot of Big Corps thought Symantec is okay, because it's (was?) expensive as fuck and it has a nice long history! (So reputation. They're on NASDAQ, they must be okay!)

But that's just business as usual. You never know when your vendor goes rouge. And really Big Corps should have plans for these events.

You're better off moving your accounts to a local credit union that does security correctly.

Have local credit unions gotten better at this? I left a local credit union a decade ago because they didn't offer online banking at all and when they finally did, the security practices they used were horrible. Memory may not serve perfectly here but I recall they had no EV cert (while common with banks, not everyone had them back then), the login form was provided in-the-clear POSTing to HTTPS and many of the banking functions were issued via GET requests, causing certain "internet accelerator extensions" that worked by requesting data before you clicked them to actually make changes to your accounts on certain pages (this is where memory doesn't serve -- I think it was a "theoretical" problem because these extensions usually didn't pre-request HTTPS pages for this very reason).

It depends upon the CU in question. There are typically /many/ local (to a state/region) credit unions, so you get multiple shots at this. SECOND, the reason you're better off is that you are literally part owner of that 'union' as a member. They inherently (typically) give you better rates and treat you better.

There is a risk but they would already lose all Android users. If Apple and Mozilla then join in they pretty much would lose all iOS and macOS users.

For a bank maybe a user would temporarily accommodate but it would affect online stores and SaaS business a lot.

Symantec's site won't get past "Loading Your Community Experience" with tracking blocked.

https://www.symantec.com/connect/tr/blogs/symantec-ca-propos...

Works for me without Javascript.

Mozilla seems in total agreement with Chrome on this, and it also takes unilateral CA authority action. This is not a negotiation where the orgs have the right side of the power dynamic.

It's always a negotiation. He who has the least to lose wins.

"Why isn't my browser working??" "So sorry about that, those darn nerds made a change on us."

I have seen this exact scenario play out. Mozilla and Google might be respected in the tech community; to most people they're an extremely tiny part of their life. "Your the IT man, just make it work"

You're arguing "Right" vs. "Easy".

Easy there Tex, I'm not arguing. I am simply describing the behaviors between large orgs in a dysfunctional ecosystem/marketplace.

As you get older, you transition from "this is how it should be!" to "this is how it works, what is a realistic amount of change that can occur?"

i would say the relevant "this is how it works" is having a globally trusted CA system that isn't abused by large CAs just because they think no one will dare punish them. What would any of these large Symantec customers says if in the future their security was compromised due to mis-issued certificates? I doubt they'd be thrilled they were saved some dev time getting their certificates signed by another root in exchange. it's very clear from Symantec's language here and elsewhere that they wouldn't be doing shit about this is chrome weren't taking it so seriously

And when Google and Moz both are "blocking a security threat" MS and Apple will have follow suit or they'll get buried by by PR and advertising attacks.

I disagree, a bank should especially be knowledgeable of security (and certificate) issues. I've switched banks because of bad security practices before, it's a simple matter of voting with your feet.

Could you give me some info about different banks' security practices?

Reply on news.ycombinator.com