Chrome 68 will mark all HTTP sites as “not secure”

Re:Chrome 68 will mark all HTTP sites as “not secure” by niij on Thursday February 08, 2018 @07:33PM (#16336897)

I think you're confusing authentication vs encryption. If you were MITMing someone and using a self signed cert for example.com that connection can be encrypted (if the user clicks through the warnings) but says nothing about your trust for the site.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by ams6110 on Thursday February 08, 2018 @07:52PM (#16336984)

Let's Encrypt, or any other low-cost SSL certificate, says very little about my trust for the site either. It's just too easy to get them to think they really mean anything.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by tialaramex on Friday February 09, 2018 @05:34AM (#16339252)

All new certificates for DNS names in the Web PKI today (and for some time now) must result from the CA having used one of the Ten Blessed Methods to validate the Applicants control over the name, regardless of who paid how much.

Let's Encrypt offered three of the Ten, but one was discovered to be flawed due to the way some major bulk hosting services are configured, so that leaves two (of Nine, since in practice any implementation of the Tenth Blessed Method is flawed the same way).

Even flawed Blessed Methods are far superior to the checking (basically none) we can reasonably expect from a normal person using a web browser. But still, improvements upon the Blessed Methods are a topic of public discussion, if you think you genuinely have a better way you should definitely let the CA/B Forum or m.d.s.policy know about it.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by niij on Friday February 09, 2018 @11:36AM (#16341581)

Having any valid cert (DV or otherwise) proves that you are viewing the example.com that the owner of example.com wants you to see. Without a certificate, you can/will be MITMed.

>It's just too easy to get them to think they really mean anything.

I'm not sure what you mean by this:

1. Are you saying that there is a vulnerability where you can get a valid certificate for a domain you don't own?

2. Do you mean the fact that valid owners of a domain can get a certificate easily?

If 1, please provide more info. If 2, why is that a bad thing?

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by dragonwriter on Thursday February 08, 2018 @07:54PM (#16337000)

An expensive DV certificate doesn't really say any more than a cheap one, except that the person buying it had money to burn.

Whether an EV certificate should do much more for trust than DV is a matter of some debate.

[ Parent | on HN ]