Slashdot Mirror
Symantec To Buy VeriSign's Authentication Business
overThruster writes "Security giant Symantec is taking another step toward global domination of the information security market with the purchase of VeriSign's authentication business. Back in April it purchased PGP Corporation and GuardianEdge. VeriSign is the best known Certificate Authority; they are virtually synonymous with certificates for SSL and PKI. It seems like this could dilute the trust value of their brand rather than enhance it. It is not clear yet what effects this will have on VeriSign customers but the cynic in me says it can't be good. In terms of putting all your eggs in one basket, this will sure make Symantec a juicy target for hackers (as if they weren't already). Imagine you could hack one company and control a large chunk of endpoint security software and the bulk of the Internet's public key infrastructure."
Nothing good can come of this...
Find a way to make SSL certification slow down your computer as well? Maybe they intend to slow down the whole internet?!?
sudo mount --milk --sugar
... and failure is inevitable.
Laudele lor desigur m-ar mahni peste masura.
instead, imagine you were a government official with no interest in civil rights and could quietly "persuade" one company and have access to the Root Certificate Authority...
I'm surprised that EMC didn't outbid them to get the Verisign certificate business, as well as for PGP earlier. It seems like it would have been a great fit with RSA, and EMC has oodles of cash for acquisitions.
Apple should buy Symantec, move the PC security workers over to Mac security exclusively, and incorporate PGP technology into Mac OS X and iPhone OS, to produce the most security- and privacy-concious platforms in the industry.
This might not be such a bad thing. Perhaps it will help encourage the community as a whole to ditch the shitty hacks that are SSL and TLS.
If security is the problem, certificates are basically never a good answer.
They have done wonders for Netbackup (soon be known as BackupExec Super Plus from Altiris and dropping non-Windows support)
As for it being a single point of failure...no way. That would require them to actually integrate all the technology they buy...it's all still the same individual bits and pieces with updated panels and bitmaps....
Imagine you could hack [Symantec] and control a large chunk of endpoint security software and the bulk of the Internet's public key infrastructure.
I'm sure they buy anti-virus and firewall software from a reputable vendor.
Imagine you could hack one company and control a large chunk of endpoint security software and the bulk of the Internet's public key infrastructure
Sure, that'd be a nightmare, if it was possible to "hack a company". If Symantec has any sense at all (and as a security company, they just might) they will keep the certificate authority separate from the antivirus update servers. There is no reason why rooting either one should be able to get you the other, whether they're controlled by the same company or not.
DRM: Terminator crops for your mind!
If security is the problem, certificates are basically never a good answer.
How else should I be sure that I am communicating with the entity I think I am communicating with? I can think of three models: certificate authority, web of trust, and key continuity management. If you're referring to key continuity management, the approach used by SSH that makes sure that the key you're using matches the key you used last time, that doesn't work if you're behind an ISP that's all MITM all the time. (Yes, these exist in the wild; see bug 460374 at bugzilla.mozilla.org.) If you're referring to a web of trust based on the Bacon number of mutual face-to-face meetings at key signing parties between you and a company's CIO, that doesn't work for people who can't attend such parties in major-league cities.
Now they can make virus that can generate valid SSL certificates!
ha ha ha.
Not related to SSL and stuff like that, but anyway: a few years ago I got a job working doing technical support for Symantec. During training, I was first embedded with the customer service-people, and watched them sit talk to customers, while they took down credit card numbers and other details on paper, which were later thrown out the the general office-trash.
A few days later I was supposed to do "technical training" with the so-called 2nd line support... The day I had to explain to one of them how to unlock the taskbar on Windows XP was the day I quit - after a total of 6 or 7 days of employment.
And who buys their stuff anyway? I haven't touched any of it since then so I don't know if anything has improved, but I remember how the Norton Security-packages idea of protecting the computer was to slow it down to a crawl and basically block everything. Not to mention what a mess it is (was?) to remove it from the system...
I can see his bespectacled face showing up on my website telling me I have a virus and that I'd be better buying the whole Norton Internet Suite from Symantec.
The Kai's Semi-Updated Website Thingy
Fantastic, now when you install an SSL Cert your computer will slow to a crawl, to uninstall the cert will require a complete rebuilt/reimage.
Might as well put your keyboard at the bottom of a six foot-deep vat of molasses...cold, cold molasses...and start training.
Orwell: "In a Time of Universal Deceit, telling the Truth is a Revolutionary Act"
This is called diversification. Anti-virus is their flagship product, but the "benefit of the benefit" as they say in marketing is the warm fuzzy feeling of being secure. Well, certificates make people feel secure the same way AV does, so it fits the brand, so they're going to sell them. It's a great investment for them, I'm sure they'll make money on this deal.
All the time here on Slashdot I see people trying to read a technological message in a business decision or action. If you're puzzled or outraged by whatever Apple or Symantec or whoever are up to, just follow the dollar signs. This makes business sense and there's nothing more outrageous about Symantec selling certs than anyone else. Really. It's just business. There's no meaning here.
[...]Security giant Symantec is taking another step toward global domination[...]
Did anyone else read that as "another step backward"?!
Let's see. Symantec makes overpriced, underperforming security software you can't get rid of in a glossy, well designed box.
So, essentially, the "secured by VeriSign" logo will look better.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Verisign lost points with me on their handling of DNS.
They'll lose all credibility once their certificates are gone. Symantec is laughed at by the few people who buy certificates.
At least they're unhackable; they have Norton after all.
The two Symantec products I use are the AV client / server line and Backup Exec. Both of which cause me nothing but trouble. This is going to be bad for everyone.
No sig for you. YOU GET NO SIG!
Thinking back to the feds getting their keystroke logging software whitelisted.
http://en.wikipedia.org/wiki/Magic_Lantern_(software)#Symantec
Then you have Symantec wanting to acquire the encryption companies PGP and GuardianEdge.
Soon many PC's will run to end Symantec solutions for all their data security.
Symantec: "The FBI's most trusted antiprivacy solution"
Domestic spying is now "Benign Information Gathering"
... but smell worse.
Cheers,
"What in the name of Fats Waller is that?"
"A four-foot prune."
Something as fundamental to business and security on the internet as a certificate-authority, shouldn't be at the mercy of a private, for-profit business. Imagine if passports or driver's licences were controlled by a private company who could sell that operation to anyone they wanted.
Even if Symantec were the most honest and scrupulous company in the world that could all change with no input from the real stake-holders, ie vritually everyone who uses the internet. They could make a mistake in their security procedures which aren't subject to outside scrutiny, they could sell the operation to someone else, etc.
Of course this sale only highlights the problem. It was a problem before they bought it, too.
If other software solutions by Symantec are any indication of what is to come, this can't be a good thing. I can't wait for the nag screens and subscription renewal screens to be blasted at us left right and center.
That's not to say that VeriSign itself is free of issues, but Symantec is known for their over-complicated, bloated, inadequate software, and they should focus on building a competing product.... Oh wait! They can't possibly compete with VeriSign! The only solution is to buy them out.
Wonder what the competition bureau has to say about that. I know if Microsoft ever tried to by out such thing, bells and whistles would go off.
Noooo.....
Every time I kill off my "last" Symantec app, they buy something else I'm using. It takes them 12-18 months to kill a product, and it takes me 24 months to swap it out.
I wonder if the transaction will take place through an SSL secure connection.
Verisign's milk cow is their SSL certificates for websites.
They need a huge infrastructure to analyse and issue personal certificates. Profit margins are a lot lower in this case.
They're just cutting a not-so-profitable business and keeping their main income untouched.
...into a black hole. These Symantec / Verisign / PGP mergers show how the utterly decrepit Windows PC market failure (desktop monopoly, plus a small handful of app vendors like Symantec) has made the Internet much more treacherous by failing to deliver reasonably secure systems. And now these incompetent and greedy beasts (who are in fact more interested in hobbling our computers to keep us on that 3-year upgrade cycle) are going to finish the job by devouring important Internet institutions.
Symantec: The gross Microsoft toadies who not long ago tried to scare Mac users into buying their crapware with fevered stories of impending viral doom. Their white papers have the tone of 'buy into our security model you little mislead Unix neophytes, or your computers are gonna get it any day now!'
BE VERY AFRAID OF THIS MERGER.
Symantec are not Google or Apple or even Microsoft. They will not even be Verisign after acquiring that company. Not all corporations have the same work culture and Symantec in particular are a bunch of MBAs who are sucking the life out of the computing field. If they all spontaneously combusted today, they would not be missed by anyone but their shareholders for more than 5 minutes.
Just got an email from Thawte about our SSL Certs:
"Upon closing of the transaction, Thawte and its retail and enterprise offerings will become part of the Security and Compliance Group at Symantec. Certain Authentication related brands and trademarks, such as the Thawte seal, will be included in the transfer to Symantec."
Here is the whole email:
Dear Thawte Customer,
I am writing to inform you that VeriSign, Thawte's parent company, has signed a definitive agreement to
sell our Authentication Services business to Symantec, a premier end-to-end Internet security provider
with extensive distribution, broad product offerings and integrated service delivery. Upon closing of the
transaction, Thawte and its retail and enterprise offerings will become part of the Security and
Compliance Group at Symantec. Certain Authentication related brands and trademarks, such as the
Thawte seal, will be included in the transfer to Symantec.
In the last few years, the industry has seen consolidation in the security market, and we have heard
repeatedly from you, our customers, of your interest in having our offerings integrated into a larger
services suite. The combination of Thawte's SSL product lines with Symantec's broad portfolio of
information security solutions delivers on this request. You will now be able to authenticate your
business, secure your website and transactions, safeguard your corporate network, and protect
employee accounts and devices with a suite of products from a single company.
Over the years you have supported us with your business and helped guide us on our product
development and company strategy. It is because of this that Thawte and parent company VeriSign have
category-leading products and is a brand synonymous with trust on the Internet. I'd like to emphasize that
we plan to continue this effort during the transition period and onward. Additionally, you can expect the
following from us going forward:
- Continued product support and service. All Thawte product and support contract obligations will
be upheld. Nothing changes here. All support procedures, announced support timelines, and contacts
remain unchanged, so please continue to use the same account management, sales, product,
business and customer support channels you've been using.
- Continued access to personnel and management. To help ensure a quick and seamless
integration in conjunction with uninterrupted continuity of your services, Authentication Business leads
Atri Chatterjee and Fran Rosch will remain with the business along with most of the Authentication
Service employees. Additionally, your Thawte points of contact will remain the same throughout the
closing process, which we anticipate will be within 60 to 90 days. Any changes after that will be
announced well in advance ensuring that the transition is smooth.
- Improved technology and product synergies. We expect customers will benefit from the broader,
complementary product offerings brought by VeriSign and its brands with Symantec: from leveraging
Symantec's security research and analysis technology to including strong authentication as a core
component of data leak prevention.
We are dedicated to bringing world class services to our world class customers. Please do not hesitate to
reach out to your local point of contact if you have any questions or concerns.
Thank you for your continued support.
Sincerely,
Mark McLaughlin
President and CEO
VeriSign, Inc.
Theora: What if some really dangerous people got control of it?
Murray: Who do you think controls it now?
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?