SoylentNews is people
SoylentNews
Submitted via IRC for TheMightyBuzzard
Google announced in March its intent to stop trusting all Symantec-issued digital certificates due to the certificate authority's failure to play by the rules. Symantec, its subsidiaries and its partners had been accused of making too many exceptions from Baseline Requirements (BR) in favor of their customers.
The developer of the Chrome web browser initially proposed the reduction of the validity period for newly issued Symantec certificates to nine months or less, gradual distrust and replacement of all existent certificates, and the removal of extended validation (EV) status for Symantec certificates.
[...] After some debate, Google made a second proposal that involves Symantec partnering with one or more existing CAs and using their infrastructure and validation process. Symantec would still handle business relations with customers and all CAs would be cross-signed by the company.
[...] Mozilla has advised Symantec to accept Google's second proposal and said it's open to discussing its implementation. However, if Symantec refuses, Mozilla may take alternative action to "reduce the risk from potential past and future mis-issuances by Symantec, and to ensure future compliance with the BRs and with other root program requirements."
Source: http://www.securityweek.com/mozilla-tells-symantec-accept-googles-ca-proposal
(Score: 2, Disagree) by mcgrew on Thursday May 04 2017, @07:05PM (1 child)
I ran across one in Firefox yesterday from Google News. Despite there being no reason at all to need a security certificate for a well-known newspaper. It was hard (and annoying) to get past the multiple warning screens. It isn't like I was buying something or downloading software, those are the places that need certificates.
My guess was that one of their advertisers had a bad cert.
mcgrewbooks.com mcgrew.info nooze.org
(Score: 2) by KiloByte on Thursday May 04 2017, @09:41PM
My guess was that one of their advertisers had a bad cert.
Yet another thing that Request Policy fixes. Or at least Adblock with a good list, but advertisers multiply like vermin they are, so a blacklist-based approach is never accurate enough.
Ceterum censeo systemd esse delendam.