Why does plus.google.com use a *.google.com cert? Seems like extremely poor decision by the plus team and Google Online Security to allow use of a domain wild card cert. In fact, why does a *.google.com cert exist? If you think, nothing wrong with the practice then is plus the only product/service to use a wild card cert?
That's why we should finally switch to TLSA RRs, which only make sense with DNSSEC.
If you, fellow readers, administrate a DNS service at your company, get DNSSEC set up. TLSA or CAA afterwards is trivial. Chrome already verifies it, Mozilla has plans to do so (also a nice introduction): https://wiki.mozilla.org/Security/DNSSEC-TLS-details#Embedding_Certificate_Information_in_DNS
The conclusion of the post notes that Google "may also decide to take additional action after further discussion and careful consideration," which to me hints that the Chrome team, as others, are likely considering whether to continue including TURKTRUST root. While I fully appreciate the ramifications of the breach, I would inveigh upon the community to take time to consider subsequent actions. Unfortunately, due to banking embargoes against sanctioned states, there are very few CAs that accept customers from Iran and Syria. TRUSTTRUST and ipsCA (not trusted) are likely the primary CAs for these audiences. Unfortunately if this CA is removed, it is likely that the decision will push many sites into the national, not-trusted and completely compromised CA ParsSign.
As a Turkish citizen, I agree that Turktrust should be condemned. However, previously and duly issued certificates should not be revoked, it is not fair for the merchants who may not (and in all likelihood do not) understand what is going on. That said, I'd like to reiterate that I agree with Google's decision.
Google should ASAP improve the extensions' API to allow extensions like SSL observatory and Convergence to be created for Chrome. Firefox had the proper API for years and I am really thinking of switching back to Firefox because of Chrome's crippled API.
In other words if you actually care about user privacy, give the users tools to make stuff to protect their privacy as *they* see fit.
@Nephilim My understanding is that Chrome knows who the issuers of the real Google certificates are, so that it can immediately identify a fraudulent certificate.
so still intermediate CA are issuing such kind of digital certification. If this is happening then how actual digital certificate can be redeem with the parent CA.
Following your online education management site I get more information for my buisness ,If you want to know further more for enhance your buisness follow us on:-The main areas online fake certificates of concern are the rising and growing popularity of so many website fake college transcripts and the standard of study is also falling. It is really important and essential for all organization and also the government to take online fake degrees stringent steps to stop such acts. Make sure you read this article and underside every basic novelty diplomas of the piece and its importance.
Following your education-Digree site I get many information you just follow us on:- The main role of this fake university degrees author is to make you aware about different changes and modifications that are coming when it has to do with fake certificates and other essential which are fake transcripts available, just make sure you follow all such cats and this will guide you through the process of proper career with a valid online fake certificates. You realize and recognize the various fake college transcript impact and effects of original certificates.
Follow
18 comments :
MSFT is pushing update
Microsoft Security Advisory 2798897
Fraudulent Digital Certificates Could Allow Spoofing
http://technet.microsoft.com/security/advisory/2798897
Its a good example of how the best security pracitces we have still go terribly wrong at times.
Daniel Wozniak
Why does plus.google.com use a *.google.com cert? Seems like extremely poor decision by the plus team and Google Online Security to allow use of a domain wild card cert. In fact, why does a *.google.com cert exist? If you think, nothing wrong with the practice then is plus the only product/service to use a wild card cert?
That's why we should finally switch to TLSA RRs, which only make sense with DNSSEC.
If you, fellow readers, administrate a DNS service at your company, get DNSSEC set up. TLSA or CAA afterwards is trivial. Chrome already verifies it, Mozilla has plans to do so (also a nice introduction): https://wiki.mozilla.org/Security/DNSSEC-TLS-details#Embedding_Certificate_Information_in_DNS
@Sebastian, yes, let's put registrars and NICs in charge instead... no, thanks!
The conclusion of the post notes that Google "may also decide to take additional action after further discussion and careful consideration," which to me hints that the Chrome team, as others, are likely considering whether to continue including TURKTRUST root. While I fully appreciate the ramifications of the breach, I would inveigh upon the community to take time to consider subsequent actions. Unfortunately, due to banking embargoes against sanctioned states, there are very few CAs that accept customers from Iran and Syria. TRUSTTRUST and ipsCA (not trusted) are likely the primary CAs for these audiences. Unfortunately if this CA is removed, it is likely that the decision will push many sites into the national, not-trusted and completely compromised CA ParsSign.
Diginotar CA is gone after what happened. I hope the same will happen to TURKTRUST.
As a Turkish citizen, I agree that Turktrust should be condemned. However, previously and duly issued certificates should not be revoked, it is not fair for the merchants who may not (and in all likelihood do not) understand what is going on. That said, I'd like to reiterate that I agree with Google's decision.
@Google: Can you tell us, *how* did you find this out?
Google should ASAP improve the extensions' API to allow extensions like SSL observatory and Convergence to be created for Chrome. Firefox had the proper API for years and I am really thinking of switching back to Firefox because of Chrome's crippled API.
In other words if you actually care about user privacy, give the users tools to make stuff to protect their privacy as *they* see fit.
Locksmith: Google probably do NOT use a *.google.com certificate.
The issue here is that SOMEONE ELSE managed to create one (and one that was TRUSTED) and use it for a man-in-the-middle attack against Google.
@Nephilim My understanding is that Chrome knows who the issuers of the real Google certificates are, so that it can immediately identify a fraudulent certificate.
@Paul B:
Google uses *.google.com certs a lot. With quite a lot of Subject Alternative Names.
An example of *.google.com certs for various hosts collected just by browsing (note that some repeat, they are shared for multiple google services).
Another count from an observatory (those are all unique certs, most of which, if not all, belonging really to google):
select count(id) from ee_certs where subject like '%CN=*.google.com%' and not_after >= '2013-01-01';
count
-------
1188
(Sorry if this is double-posted, the comment system does not make it easy).
Please scope the CAs already. I don't need turktrust or any of its intermediaries signing for anything but *.tr!
so still intermediate CA are issuing such kind of digital certification. If this is happening then how actual digital certificate can be redeem with the parent CA.
It seems the time is right for DANE (RFC6698), so I hope it will be incorporated in Chrome and other browsers some day soon.
Following your online education management site I get more information for my buisness ,If you want to know further more for enhance your buisness follow us on:-The main areas online fake certificates of concern are the rising and growing popularity of so many website fake college transcripts and the standard of study is also falling. It is really important and essential for all organization and also the government to take online fake degrees stringent steps to stop such acts. Make sure you read this article and underside every basic novelty diplomas of the piece and its importance.
Following your education-Digree site I get many information you just follow us on:- The main role of this fake university degrees author is to make you aware about different changes and modifications that are coming when it has to do with fake certificates and other essential which are fake transcripts available, just make sure you follow all such cats and this will guide you through the process of proper career with a valid online fake certificates. You realize and recognize the various fake college transcript impact and effects of original certificates.
Post a Comment