Google Cuts Ties With Entrust in Chrome Over Trust Issues (theregister.com) 12
Google is severing its trust in Entrust after what it describes as a protracted period of failures around compliance and general improvements. From a report: Entrust is one of the many certificate authorities (CA) used by Chrome to verify that the websites end users visit are trustworthy. From November 1 in Chrome 127, which recently entered beta, TLS server authentication certificates validating to Entrust or AffirmTrust roots won't be trusted by default.
Google pointed to a series of incident reports over the past few years concerning Entrust, saying they "highlighted a pattern of concerning behaviors" that have ultimately seen the security company fall down in Google's estimations. The incidents have "eroded confidence in [Entrust's] competence, reliability, and integrity as a publicly trusted CA owner," Google stated in a blog. The move follows a May publication by Mozilla, which compiled a sprawling list of Entrust's certificate issues between March and May this year. Entrust -- after an initial PR disaster -- acknowledged its procedural failures and said it was treating the feedback as a learning opportunity.
Google pointed to a series of incident reports over the past few years concerning Entrust, saying they "highlighted a pattern of concerning behaviors" that have ultimately seen the security company fall down in Google's estimations. The incidents have "eroded confidence in [Entrust's] competence, reliability, and integrity as a publicly trusted CA owner," Google stated in a blog. The move follows a May publication by Mozilla, which compiled a sprawling list of Entrust's certificate issues between March and May this year. Entrust -- after an initial PR disaster -- acknowledged its procedural failures and said it was treating the feedback as a learning opportunity.
It figures (Score:3)
Google Cuts Ties With Entrust in Chrome Over Trust Issues
Can't trust a company with "Trust" in their name. Similarly, guess I'm going to have to rethink investing my money in the "Pinky-Swear We Won't Steal Your Money Crypto Exchange" and warn my wife about the clothing brand, "Honest, Our Clothes Won't Make you Look Fat". Sigh, can't trust anyone anymore -- oh, right.
Re: (Score:3)
Can't trust a company with "Trust" in their name.
That's why we still need to convince Mozilla to add Honest Achmed's root certificate [mozilla.org] instead...
Re: (Score:2)
The certificate business has been hit hard by all major browsers demoting the "enhanced" ones to the same status as a basic free cert you can get from LetsEncrypt. There is very little reason to pay for one now, at least as far as the web goes.
These guys are going bankrupt soon. Once Chrome removes them their certificates are worthless, and all their existing customers will be wanting refunds.
Shocked Google did it (Score:3)
Trust models. I know which one I trust more. (Score:3)
DigiNotar (2011): Hackers issued rogue certificates, leading to man-in-the-middle attacks.
Comodo (2011): Attackers issued fraudulent certificates for major domains, targeting Iranian users.
Symantec (2015-2017): Improperly issued numerous certificates, leading to distrust by major browsers.
Trustwave (2012): Issued a subordinate root certificate for internal security monitoring, enabling man-in-the-middle attacks.
We could replace certificate authorities (CA) (Score:2)
If we create a DNS RECORD TYPE for certificate fingerprints and we use that to authenticate public certificates from websites than we won't be required to use a CA anymore. IIUC this is as safe as what we already do today:
- It's already possible to emit a certificate based on dns authentication (https://letsencrypt.org/docs/challenge-types/#dns-01-challenge)
- Browsers already authenticate root certificates based on their fingerprints (https://chromium.googlesource.com/chromium/src/+/main/net
Re:We could replace certificate authorities (CA) (Score:4, Interesting)
But the whole point of a certificate is to make sure that if you connect to example.com, you really are connected to that machine. If someone can monkey with your DNS to get you to connect to the wrong machine, they can also monkey with your DNS to feed you whatever key fingerprint they want (think ISPs or state actors who want to MITM users.)
LetsEncrypt's DNS validation is a little different because the machine that does the DNS lookup to do the validation is not the same machine as the one connecting to a web site. So a DNS attack would be harder because you'd have to MITM both LetsEncrypt and your intended victim.
Re: (Score:2)
The solution to DNS tampering exists. Its called DNSSEC.
I would love to know why no-one wants to actually implement DNSSEC signature validation in things like browsers and other software...
Re: (Score:2)
It already exists, its called DANE. But for some reason browser manufacturers refuse to implement it even though it has benefits for security...
The end game... ? (Score:2, Interesting)
I don't know if Entrust is sloppy to the point of being untrustworthy, but I certainly don't trust Google one little bit.
From Google's POV, the ideal situation would be for Chrome to only trust Google as a CA. Maybe they're floating a trial balloon? "If nobody squawks, maybe we can whittle away at the supported CAs until we have them in our hands, muahahahaaaa!"
Re: (Score:2)
Apparently there's this policy field cPSuri that was both considered "NOT RECOMMENDED" but also "REQUIRED" for EV certs. They're eventually going to fix the discrepancy to make it consistent with the non-EV certs. But in the mean time some douchebag autist is raising a stink calling for Entrust to abruptly revoke 25000+ certs because "rules are rules, reeeeeee".
The downtime that would be caused by Entrust pulling the rug out from under their customers is too great. Especially for something so trivial as