Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Bans Symantec Root Certificates

Posted by timothy on from the more-than-a-slap-on-the-wrist dept.

An anonymous reader writes: After in September Google discovered SSL certificates issued in its name by Symantec, and after in October the company discovered over 2,500 more certificates issued for non-existent domains, also by Symantec, Google has now decided to ban Symantec's dodgy certificates from Android and Chrome. "Symantec has decided that this root will no longer comply with the CA/Browser Forum's Baseline Requirements," said Ryan Sleevi, Google Software Engineer. "As these requirements reflect industry best practice and are the foundation for publicly trusted certificates, the failure to comply with these represents an unacceptable risk to users of Google products." Apparently Symantec hasn't been very careful of where and to whom it issues SSL certificates from a particular root branch.

84 comments

  1. lemme guess by Anonymous Coward · · Score: 1

    not ALL symmantec certificates...

    1. Re:lemme guess by binarylarry · · Score: 1

      I bet something that broad would generate a lawsuit, possibly some kind of antitrust litigation.

      --
      Mod me down, my New Earth Global Warmingist friends!
    2. Re:lemme guess by bwcbwc · · Score: 1

      I bet something that broad would generate a lawsuit, possibly some kind of antitrust litigation.

      RT*A: Google claims they are doing it at Symantec's request.

      As Symantec is unwilling to specify the new purposes for these certificates, and as they are aware of the risk to Google’s users, they have requested that Google take preventative action by removing and distrusting this root certificate.

      --
      We are the 198 proof..
    3. Re: lemme guess by binarylarry · · Score: 1

      RTFPC

      --
      Mod me down, my New Earth Global Warmingist friends!
  2. Totally over-stated summary by ttucker · · Score: 4, Informative

    From TFA:

    As Symantec is unwilling to specify the new purposes for these certificates, and as they are aware of the risk to Google’s users, they have requested that Google take preventative action by removing and distrusting this root certificate.

    Later in TFA:

    Symantec has indicated that they do not believe their customers, who are the operators of secure websites, will be affected by this removal.

    Symantec is retiring the certificate, and has asked for it to be removed from Google (and probably other) products. End of story. Nobody should be affected.

    1. Re:Totally over-stated summary by Anonymous Coward · · Score: 0

      That's not the only reason the summary is bad...
      That first sentence is hard to read.

    2. Re:Totally over-stated summary by Anonymous Coward · · Score: 0

      Symantec didn't say what it will be used for because the government is telling them they have to keep it secret. Maybe a new way for NSA et al. to install software on the computers of ISIS and/or ISiS supporters.

    3. Re:Totally over-stated summary by Anonymous Coward · · Score: 0

      Exactly, this has nothing to with what happened in September.

    4. Re:Totally over-stated summary by jbmartin6 · · Score: 4, Interesting

      It didn't sound like they are retiring it, they just wouldn't say what they were doing with it and requested the removal. Which I guess is sort of like a retirement, but implies they will continue to use it for some unstated purpose. Almost as if some agency were forcing them to misuse it and they are skirting some legal requirement by asking others to stop trusting it. But that is 100% speculation on my part.

      --
      This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    5. Re: Totally over-stated summary by Anonymous Coward · · Score: 4, Informative

      It is a really lousy summary. This is the G1 class 3 root CA VeriSign issued in 1996! If I remember correctly, it's a 1024 bit RSA root, and it hasn't been used in production in 5+ years. Removing it permanently from being trusted will doubtless break a few ancient systems that haven't been updated in forever, but it's the right thing to do. Not a sign of anything more than obsolescence.

    6. Re:Totally over-stated summary by whoever57 · · Score: 1

      Symantec is retiring the certificate, and has asked for it to be removed from Google (and probably other) products. End of story. Nobody should be affected.

      Translation: the NSA no longer needs to use certificates that are signed against this root.

      --
      The real "Libtards" are the Libertarians!
    7. Re: Totally over-stated summary by yuhong · · Score: 1

      Yea, Mozilla killed or limited to email this and most other 1024-bit roots sometimes ago.

  3. bad links by Anonymous Coward · · Score: 0

    the link in the article that tries to show proof, is broken. personally i use cacert, so this doesn't bother me either way.

  4. thats racist!!! by ganjadude · · Score: 0

    You mean we are going to ban ALL of symantecs root certs because of a few bad apples??? ;)

    --
    have you seen my sig? there are many others like it but none that are the same
    1. Re:thats racist!!! by ttucker · · Score: 2

      The summary tried as hard as possible to imply that this was some acrimonious thing, but it is not.

      Symantec asked Google to distrust a specific CA root, end of story. Nobody affected in any way, except maybe people who do not install updates.

    2. Re:thats racist!!! by Anonymous Coward · · Score: 1

      No, Symantec didn't just inform Google that they should just remove the certs. Google found something "not quite right" multiple times after which they informed Symantec, and are now in the process of having the CA root cert removed. It's at THIS point that Symantec said "oh yeah, just remove it, no one will be affected". They would have never said anything had Google not found something, and they still haven't publicly made a statement.

    3. Re:thats racist!!! by TechyImmigrant · · Score: 5, Interesting

      The summary tried as hard as possible to imply that this was some acrimonious thing, but it is not.

      Symantec asked Google to distrust a specific CA root, end of story. Nobody affected in any way, except maybe people who do not install updates.

      Having spoken with some of the people involved, it certainly was an acrimonious thing.

      You would be pissed too if a big CA was signing forged certs of your web site's identity to someone else.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    4. Re:thats racist!!! by ttucker · · Score: 1

      Right, Google was not happy with Symantec about that happening, and the summary is strongly trying to imply that Google is punishing Symantec by interrupting the value of their certificates... from TFA we can read that Symantec does not anticipate that any of their SSL customers will be affected.

    5. Re:thats racist!!! by AmiMoJo · · Score: 2

      Google noticed that there were major problems with a Symantec root cert. Symantec were basically forced to ask for removal to retain accreditation on other root certs. If they can't say what this one is for, we can be 99% sure it was the government forcing them to issue it, which if itself quite a scandal. More proof that we can't trust Symantec software.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  5. yup. by leuk_he · · Score: 2

    O cannot see the difference between one root ceritifcate owned my symatic/verisign, and an othter. So they just went bad on one root, they just move their bad practice to an other root CA they own.

    Ban all verisign(=symatic) CA issued from now on!

  6. How about banning others? by Anonymous Coward · · Score: 2, Insightful

    I wind up cleaning my Android device's cert store just because there are a lot of certs that are made by foreign governments, that are not really used, but can easily be abused. China's government has one, for example. Same with Turkey and Saudi Arabia.

    What Google should do is figure out the geographical location used, disallow certs that are not directly appropriate to the region, perhaps allowing certs to be turned on/off if one travels. As it stands now, the fewer, the better.

    1. Re:How about banning others? by Anonymous Coward · · Score: 0

      The problem with this is that while Android allows you to install your own certs on demand, there is no way to flag user-installed certs as trusted. The reason given for this is "security".

      So Google's policy of not trusting users has painted them in a corner where they MUST include every CA possible. Including those from the many suspected-but-not-definitely-confirmed-bad CAs.

  7. After ?? in September-we must make a stand, nerds! by Provocateur · · Score: 2, Insightful

    Please, enough of improper use of English in our website! I don't mind so much in posts, but at least can we have decent grammar and syntax in TFS? Our website is not written by 11 year olds who missed Sesame Street's first ten seasons; they are written by adults who are expected to know that the words before and after are usually tied to a certain event, e.g. "after" the aliens came or "before" I lost all my hair. If I knew where you guys work, I could volunteer to work there full time, and help out.

    --
    WARNING: Smartphones have side effects--most of them undocumented.
  8. Re:We need SSL/TLS infrastructure written in Rust. by binarylarry · · Score: 5, Funny

    Yep, we really need to rewrite our entire infrastructure in your favorite language platform flavor of the month.

    Just to be secure. Think of the children.

    --
    Mod me down, my New Earth Global Warmingist friends!
  9. Re: We need SSL/TLS infrastructure written in Rust by Anonymous Coward · · Score: 1

    Good luck with that! I'm sure you'll do a great job.

  10. Re:We need SSL/TLS infrastructure written in Rust. by tshawkins · · Score: 3, Informative

    99% of tbe infrastructure of the internet is written in c/c++, every OS, most of the webservers, all of the dns infrastructure, most mail mta's, most routers,. It would be infeasable to perform a complete rewrite.

  11. APK by Anonymous Coward · · Score: 0

    Have you heard the one about the mentally delusional guy who's about to come around here and claim his Windows program could have somehow prevented certificate problems?

    1. Re:APK by Anonymous Coward · · Score: 0

      Anyone who writes letters in LISP has got to be a half bubble out of plumb.

  12. Re:We need SSL/TLS infrastructure written in Rust. by SlickUSA · · Score: 1

    hilarious!

  13. Can we get DANE support already? by Anonymous Coward · · Score: 0

    FFS, why do we still not have DANE support in Firefox and Chrome?

    1. Re:Can we get DANE support already? by KiloByte · · Score: 2

      There's an extension for both Firefox and Chromium that validates DNSSEC and DANE.

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
  14. egregious misrepresentation by Anonymous Coward · · Score: 5, Interesting

    I would say that Symantec issuing Certs with Google's name on them would qualify as egregious misrepresentation, on the behalf of Symantec, and be grounds to suing symmantec into oblivion by Google.

    Really, perhaps that's a better response for Google.

    It could even fall under the context of identity theft and grounds for criminal charges to be filed; another good response and not exclusive of a civil lawsuit based from Google.

    1. Re:egregious misrepresentation by Anonymous Coward · · Score: 0

      It could also get hushed up by a NSL, depending on who actually used the fake Google certs.

    2. Re:egregious misrepresentation by Anonymous Coward · · Score: 0

      "Egregious misrepresentation" is just "misrepresentation" with someone opining that it's "egregious" (not a term of law and entirely subjective).

      "Material misrepresentation" is purposeful and deliberate misrepresentation to induce a party to enter into an agreement or contract.

      Perhaps that is what you meant.

      E

    3. Re:egregious misrepresentation by Anonymous Coward · · Score: 0

      No. No. It couldn't.

      NSLs are used to REQUEST information and disallow sharing the existence of the REQUEST for information.
      They have nothing to do with using certs or crafting certs etc.

    4. Re: egregious misrepresentation by Anonymous Coward · · Score: 1

      Law school students are by far the most irritating people on the planet. Perhaps that's what you meant.

    5. Re: egregious misrepresentation by Anonymous Coward · · Score: 0

      Law school students are by far the most irritating people on the planet. Perhaps that's what you meant.

      I love arguing with lawyers though. Because they seem to think they're so good at it. The tend to assume one context, when it isn't. And they like to change the contexts, then hate it when they get caught.

      Basically, they good at rhetoric, but tend to suck at actually attacking or even defending a point on the fly.

    6. Re: egregious misrepresentation by Anonymous Coward · · Score: 0

      Thanks. That makes me feel so much better about the possibility that the US Government got Symantec to issue fake certs for Google so they could MITM SSL session without anyone realizing it.

    7. Re: egregious misrepresentation by KGIII · · Score: 2

      That doesn't mean that didn't happen. What it means is that the mechanism for that is not an NSL. People seem, for some odd reason, to misunderstand the scope of an NSL. They are not some Swiss Army Knife approach where you get to do all sorts of things under one heading. They're quite specific and quite limited.

      This, of course, doesn't mean that there aren't other issues. This doesn't mean that they're not doing some of the things that they're accused of. This doesn't mean that they're not engaging in unconstitutional activities. This simply means that they're not using the NSL to accomplish those things.

      --
      "So long and thanks for all the fish."
    8. Re:egregious misrepresentation by davester666 · · Score: 1

      Yes, that why FBI agents also carry guns.

      --
      Sleep your way to a whiter smile...date a dentist!
    9. Re: egregious misrepresentation by Anonymous Coward · · Score: 0

      Anyone who has ever employed a lawyer knows this well.

    10. Re:egregious misrepresentation by thunderclap · · Score: 1

      I wish Google would just buy them and then shut them down. Its a much better outcome.

    11. Re: egregious misrepresentation by thunderclap · · Score: 1

      "The first thing we do," said the character in Shakespeare's Henry VI, is "kill all the lawyers."

    12. Re:egregious misrepresentation by swillden · · Score: 1

      I wish Google would just buy them and then shut them down. Its a much better outcome.

      Symantec's shareholders and all of Symantec's competitors wholeheartedly agree.

      It's less clear that it would do the world any good, and very clear that it would do Google none.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    13. Re: egregious misrepresentation by Anonymous Coward · · Score: 0

      Have you ever seen an NSL? Have you ever been presented with one? Did you take it to your lawyer?

    14. Re: egregious misrepresentation by Anonymous Coward · · Score: 0

      Sorry for the AC response but Slashdot is bitching at me. No, I've never seen one. I do know what they entail, however. They've been able to publish a few of them, here and there, on the 'net. Wikileaks has a couple up, last I knew. They're also codified into law what they can do. Hell, we just had an article on here about some abuses that have gone on with them. You'll note, none of those abuses are anything like was suggested.

      Again, for clarity, I stated this and I thought it was clear... But, this does not mean that this is not being done. This does not mean that there aren't bad things happening. What it does mean is that they mechanism for doing this is not an NSL. The NSL is a request for information and not a call to action. An NSL may come with conditions that you not disclose having received one or notify the people whom you are informing on. The NSL is not a mechanism for you to put backdoors in, MITM, or otherwise act in the future with the exception of disclosure.

      This doesn't mean that they're not doing that. They might be, who knows? It does mean that they're not using the NSL as the mechanism to do this. A monkey wrench is cheaper and doesn't leave as many witnesses or paper records and, frankly, that's not what the NSL is capable of insisting. It'd be silly to use an NSL for such a thing and the NSL doesn't even empower such a thing. They're probably bribing or blackmailing. They might even just be plain threatening violence or doing it covertly. Who knows? It's just not an NSL that's being used.

  15. I've never list THAT as a benny of hosts use by Anonymous Coward · · Score: 0

    See subject: So you can quit your disinformation/misinformation campaign you weak scumbag imbecile, ok?

    * Dicks like YOU online make me laugh... how/why?? Easy: You're NOT strong enough technically to validly disprove lists of facts I put out on hosts files being superior to ANY single browser addon redundantly stupid illogical method of adblocking (& hosts do FAR MORE THAN JUST THAT protecting you) -> http://it.slashdot.org/comment... BUT hosts also do a LOT MORE (like stopping botnet communication, being multiplatform OS wide across apps AND stopping DNS security issues too) & far more efficiently as well!

    APK

    P.S.=> I am glad in 1 capacity that you waste your time this way - it prevents DOLTS like yourself even attempting to write software (you'd make a wreck of it even IF you could manage such a feat), thank god... lol!

    ... apk

    1. Re: I've never list THAT as a benny of hosts use by Anonymous Coward · · Score: 0

      Talking about wasting time, can't you have your Aspie Time on your own twist that no one follows

    2. Re:I've never list THAT as a benny of hosts use by Anonymous Coward · · Score: 0

      My theoretical botnet is programmed to talk to 69.69.69.69. How would a hosts file prevent this?

    3. Re: I've never list THAT as a benny of hosts use by Anonymous Coward · · Score: 0

      Proprietary windows program. Yeah, that's real secure.

  16. You've misread the summary. by Anonymous Coward · · Score: 0

    > Symantec is retiring the certificate, and has asked for it to be removed from Google (and probably other) products.

    You're misreading that. Google's users, not Symantec, are the ones who requested its removal and Symantec did not say what they're using the cert for ("Symantec is unwilling to specify the new purposes for these certificates").

    1. Re: You've misread the summary. by Anonymous Coward · · Score: 0

      I think you are misreading it. The "they" has an unclear referent, but from context it is pretty clear that Symantec themselves requested the cert to be removed because they want to use it for secret purposes.

  17. Re:We need SSL/TLS infrastructure written in Rust. by TechyImmigrant · · Score: 2

    >can we really consider the entire system to be secure?

    It goes far deeper than the coding. It is insecure on many levels. I have deployed real world CAs. I know people embroiled in the day to day problems. While I'm not going to go into details, suffice to say the whole edifice is fragile and subject to many single points of failure and in general, the majority of single points of failure are humans.

    --
    I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  18. Re:We need SSL/TLS infrastructure written in Rust. by TechyImmigrant · · Score: 2

    Yep, we really need to rewrite our entire infrastructure in your favorite language platform flavor of the month.

    Just to be secure. Think of the children.

    Improved languages might help a little, but the deep cleaning required is that we get rid of X.509 and TLS and replace it with an auth model that works and crypto protocols that are simple enough that they can be understood and implemented well.

    --
    I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  19. Hi, my name is Günter from Google... by Anonymous Coward · · Score: 0

    Send me SSL Cert, here is $20 fee.

  20. Re: We need SSL/TLS infrastructure written in Rust by Anonymous Coward · · Score: 2, Insightful

    Rust uses LLVM as it's backend compiler. LLVM is written in C++. Where is your rust god now?

  21. I don't have "assburgers" mental issues by Anonymous Coward · · Score: 0

    See subject: So stop projecting YOUR ISSUES onto me, ok? Good... now grow up too!

    APK

    P.S.=> It must truly BLOW to be a waste of life, food, time, oxygen & water "ne'er-do-well" like yourself... apk

  22. If a threat uses IP addresses use a firewall by Anonymous Coward · · Score: 0

    See subject: You could put nj-69-69-69-69.sta.embarqhsd.net [69.69.69.69] into hosts but if you're "theoretical bullshit" is using ip addresses vs. host-domain names? Stick to the subject (& quit playing stupid you ignorant bastard troll)...

    * :)

    (I am GLAD dolts like you waste their lives this way - I don't have competition out of "the trolling waste of life" losers like YOU online!)

    APK

    P.S.=> Don't you have anything BETTER to do than to be a douchebag online? Apparently not (idle hands are the devil's workshop, so, do yourself a favor & say this out loud where you are "SATAN GET THEE BEHIND ME!" for your sake...)

    ... apk

    1. Re:If a threat uses IP addresses use a firewall by Anonymous Coward · · Score: 0

      >not using a hardware ASA
      >trusting software
      >trusting methods of computer identification on 1998 technology as a viable security layer
      >TRUSTING AV COMPANIES WHEN IT'S OBVIOUS THEY'RE THE ONES WRITING VIRUSES.

      Anyone trusting APK is a fucking fool.

  23. This is why I won't use them by Anonymous Coward · · Score: 0

    My self-signed certs (used internally) are trusted by me.
    You jokers are not trustable (Microsoft, Symantec I'm looking at you)
    (BTW, ever noticed their root CA's are self-signed, but we're told not to trust self-signed certs?)

    1. Re:This is why I won't use them by tepples · · Score: 1

      My self-signed certs (used internally) are trusted by me.

      A lot of companies operate an internal CA. But what certs do you use publicly?

      BTW, ever noticed their root CA's are self-signed, but we're told not to trust self-signed certs?

      Root certificates are self-signed by definition. We're told not to trust self-signed certificates other than those that come in the system certificate store or the ones deployed by the employer's IT department through Group Policy.

  24. Not a Minor issue, Major! Issue for devices by Anonymous Coward · · Score: 0

    insanity.. pure insanity.. Symantec may try to spin it as damage control, but this is an incredibly Bad thing for them to do

    the problem is this [Worm] has already been let loose in millions or billions of devices around the world that may never be updated or use a CRL and the darned cert in question is good until 8/1/2028 its on your Windows PC now and unless its invalidated.. it will continue to be used and can be leveraged to install other certificates

    this is freakin stupid behavior from Symantec.. stupid stupid stupid

  25. Symantec will sell you internet security... by Bob_Who · · Score: 1

    That doesn't mean they actually have any of it to sell you.

    They do offer some of the best fake protection that you can download from torrent sites hosted in Somalia.

  26. Not for public sites yet by tepples · · Score: 1

    If a first-time visitor tries to visit a site that exclusively uses DANE, he won't even get as far as the "please use DANE" page without seeing a certificate error. So you'll have to use either a traditional CA (such as WoSign or StartSSL) or Let's Encrypt (if you are root on the server) to handle visitors who don't already have the "extension for both Firefox and Chromium that validates DNSSEC and DANE" installed, as well as visitors using Edge, Safari, or a Safari wrapper. And yes, you'll end up having to cater to Safari because all other web browsers on iOS are Safari wrappers, except for a couple that are remote desktops to a browser running on someone else's computer.

  27. Trust isn't transitive by tepples · · Score: 1

    But what's "an auth model that works"? The PGP web of trust isn't it because trust isn't transitive. Just because I can vouch for someone's identity doesn't mean I can vouch for her ability to vouch for others' identities. That's why X.509 certificates have the "cannot act as a CA" flag.

    1. Re:Trust isn't transitive by Uecker · · Score: 1

      But what's "an auth model that works"? The PGP web of trust isn't it because trust isn't transitive. Just because I can vouch for someone's identity doesn't mean I can vouch for her ability to vouch for others' identities. That's why X.509 certificates have the "cannot act as a CA" flag.

      In most cases, nobody needs to know the identity anyway. It would be far more important to know that it is the same website I looked at before which can be trivially achieved by storing a hash to a certificate locally after the first visit. It would also be important to know whether the destination of a link is still the intended one which could be achieved very easily with link fingerprints.

  28. Re: We need SSL/TLS infrastructure written in Rust by Anonymous Coward · · Score: 0

    The post is written like one of a grad student attending a diploma mill of a school.

  29. Always been a problem w/certificate authorities by taustin · · Score: 1

    They only thing they're an authority on is processing credit cards, and they only thing they certify is that your credit card didn't bounce.

  30. Re:We need SSL/TLS infrastructure written in Rust. by Anonymous Coward · · Score: 0

    I really doubt that this will help. We already have enough lazy programmers out in the wild with crazy ideas and utter trust in their toolchain. There are a lot of tools helping you to find possible segfaults. There are no tools to help you understanding and implementing standards. The worst problems happen because someone is thinking outside the box, which sometimes is imposed to avoid security problems.

    Rust won't help you avoid such stupid stunts like the webbrowser accepting iframes for fav-icons.
    Rust also won't help you if you optimize a security workflow and give away infomation before securing the connection.
    And lot of other shortcuts taken for convinience.

  31. Shooting you down on "hardware ASA" #1/4 by Anonymous Coward · · Score: 0

    Hardware ASA? Stupid to depend on THAT alone (especially when routers get bushwhacked like mad, DNS settings anyone??)

    CISCO "hardware ASA" = bitten by typical JAVA bugs http://www.theregister.co.uk/2...

    (As is ALL of cisco's stuff lately & by FAR MORE than just that - want more evidence? Ask... & "ye shall receive" (loads of it)).

    * By the way - I believe in LAYERED SECURITY (hosts are a big part of it) stupid -> http://www.bing.com/search?q=%... & you're talking to the guy that practically "wrote the book" on it...

    (I just don't DEPEND ON IT SOLELY, but I use a hardware firewall solution in combination with OS side firewalls + security hardening galore with patching + antivirus & yes, hosts...)

    APK

    P.S.=> To be continued... apk

  32. Shooting you down on "trusting software" #2/4 by Anonymous Coward · · Score: 0

    When I write software (in which NONE OF YOU FOUND A BUG IN since it's intro publicly in 2012)? I do! So do others (respected noted others in security who audited my code for safety OR he would not host it (let alone HIGHLY recommend it also)) -> APK Hosts File Engine 9.0++ SR-4 32/64-bit http://start64.com/index.php?o...

    * :)

    MalwareBytes' hpHosts Admin (MalwareBytes employee who verified it's source as safe http://forum.hosts-file.net/vi... ) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news...

    &

    It's safe proven by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...

    +

    Its 32-bit model too https://www.virustotal.com/en/...

    Its installer too -> http://f.virscan.org/APKHostsF...

    APK

    P.S.=> Let's see a no skills incompetent like YOU, troll, do better... ok?? I'll be waiting till the "12th of never" for THAT miracle to happen outta the TROLLING "ne'er-do-well" likes of YOU (loser)... apk

  33. Shooting you down hosts security value #3/4 by Anonymous Coward · · Score: 0

    ">trusting methods of computer identification on 1998 technology as a viable security layer - by Anonymous Coward - A LOSER WITH NO BALLS WHO WON'T IDENTIFY HIMSELF OR STAND BEHIND HIS BULLSHIT EITHER on Sunday December 13, 2015 @09:25AM (#51109513)

    Big mistake: Respected security pros back me on hosts efficacy in security (malwarebytes, eset/nod32, symantec, & even O'Reilly):

    E.G.#1 - Oliver Day (Symantec) too-> http://www.securityfocus.com/c...

    E.G.#2 - Aryeh Goretsky NOD32/ESET hosts = good security-> http://it.slashdot.org/comment...

    E.G. #3 - MalwareBytes' hpHosts' Admin hosts + RECOMMENDS my APK Hosts File Engine 9.0++ SR-2 32/64-bit-> http://hosts-file.net/?s=Downl...

    E.G.#4 - OReilly - For security -> http://oreilly.com/pub/a/windo... & For speed -> http://www.oreillynet.com/pub/...

    APK

    P.S.=> You FAIL miserably outnumbered, outthought, outsmarted & just plain OUTED - who backs you? NOBODY... lol!

    ... apk

  34. Shooting you down on antivirus #4/4 by Anonymous Coward · · Score: 0

    Where the HELL do you see me trusting antivirus alone? Answer that & I'll cut you to shreds further... that is, if the links to my security guide earlier (#1/4 RIGHT OFF THE BAT HERE SHOOTING YOU DOWN whimp) didn't already on this note OR the link below as well!

    * :)

    (You're a fool - a cowardly little TROLLING FOOL that can't even identify himself to stand behind his words... lol!)

    APK

    P.S.=> I use antivirus programs (one resident, 2 antispyware as scanners only manually operated here & periodically scanned + updated daily IF possible) but again, I do NOT depend on them solely - I use "LAYERED SECURITY/DEFENSE-IN-DEPTH" & did well on guides I've written for it (paid for it in fact winning that money) -> http://www.bing.com/search?q=p... (See JANUARY 2008 Alexander/New York there)

    Have YOU done the same OR BETTER, Mr. NO BALLS unidentifiable coward? ANYONE TRUSTING YOUR STUPID COWARDLY NO BALLS TROLL ASS IS A FOOL!... apk

    1. Re:Shooting you down on antivirus #4/4 by Anonymous Coward · · Score: 0

      Alexander P Kowalski's home address is now known.

      Prepare, people, APK's end is coming, soon. Rejoice.

      All that computer security, zero effort to protect his own PHYSICAL PII.

  35. It is secure & verified as so... apk by Anonymous Coward · · Score: 0

    "Proprietary windows program. Yeah, that's real secure" - by Anonymous Coward on Sunday December 13, 2015 @12:55AM (#51108407)

    See subject & this data that shoots your unidentifiable coward ass down in flames easily:

    MalwareBytes' hpHosts Admin (MalwareBytes employee who verified it's source as safe http://forum.hosts-file.net/vi... ) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news...

    &

    It's safe proven by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...

    +

    Its 32-bit model too https://www.virustotal.com/en/...

    Its installer too -> http://f.virscan.org/APKHostsF...

    * :)

    APK

    P.S.=> Tell us - what has a cowardly NO BALLS little unidentifiable troll that can't identify himself to stand behind his bullshit like YOU done better than the above? ZERO, lol... loser!

    ... apk

    1. Re:It is secure & verified as so... apk by Anonymous Coward · · Score: 0

      Do you deny that it is a proprietary program? Do you deny that it is a windows-only program? You can't, so you just badmouth the truth. That's what trolls do when they can't come up with anything better. Bad attitude probably means bad program. Angry and obsessed minds rarely write good code. Anyway, who needs a program to manage a host file? There are several free lists of bad host addresses and it is super easy to manage a host file.

  36. This is depreciating a SHA-1 root certificate by Anonymous Coward · · Score: 0

    The CAB forum best practices document requires CA not to issue SHA-1 signed certificates after Jan 1, 2016.
    That includes certificates that chain to SHA-1 intermediates or roots.

    Chrome has been ratcheting up warnings on sites with these certificates for some time.

    This is a request from Symantec to remove a root certificate that will no longer be in use.
    That is just good security as the certificate in question is valid to 2028.

    Not that Google may not have other issues with Symantec.

    Symantec has a free replacement program for any sites still using certificates issued from this CA root cert.

    Not a big issue unless you have not noticed that SHA-1 signatures have been being phased out over the last 10 years.

  37. I'm proud it's proprietary (it's my work)... apk by Anonymous Coward · · Score: 0

    See subject: If it's "so bad" then why does the likes of Malwarebytes folks host & recommend it - Have YOU personally done better? No.

    * :)

    When YOU can show us YOU even code, I might listen... you're no judge of ANYTHING until then & certainly NOT my peer!

    (You can STFU now, "ne'er-do-well" troll: Especially after this proof of its safety & quality as well as who verified my code (best in the business) http://tech.slashdot.org/comme... the likes of which a TROLL like you will NEVER be able to produce, lol...)

    Should I "Open SORES" it? Hell no - do you even KNOW that Chrome itself due to being Open SORES was used to create a malware doppleganger of it? It was. Wake up.

    APK

    P.S.=> Hosts run on ANYTHING with a normal BSD derived IP stack - thus, the data output result of the program IS universal & multiplatform... all it needs to be - do YOU deny that? Go for it... I'll crush you even more, lol! apk

  38. MITM from day one by tepples · · Score: 1

    In most cases, nobody needs to know the identity anyway. It would be far more important to know that it is the same website I looked at before

    That's called "key continuity management" (KCM) or "trust on first use" (TOFU). SSH uses it but recommends that you verify the key fingerprint out of band. It could be used with HTTPS or email as well, but without a way to verify the fingerprint out of band, it's vulnerable if your connection is compromised by a man in the middle from day one. Bug 460374 relates the story of how such an MITM in the wild was discovered.

    1. Re:MITM from day one by TechyImmigrant · · Score: 1

      In most cases, nobody needs to know the identity anyway. It would be far more important to know that it is the same website I looked at before

      That's called "key continuity management" (KCM) or "trust on first use" (TOFU). SSH uses it but recommends that you verify the key fingerprint out of band. It could be used with HTTPS or email as well, but without a way to verify the fingerprint out of band, it's vulnerable if your connection is compromised by a man in the middle from day one. Bug 460374 relates the story of how such an MITM in the wild was discovered.

      The benefit comes when everyone does it all the time. All traffic is encrypted and integrity checked thusly. Yes it is vulnerable to MITM on initial use, but it raises the bar for intelligence agencies because they now have to MITM everything, all the time to have a hope of pulling off a targeted attack later. Their bulk data browsing becomes fairly pointless. Instead they have to perform bulk MITMing.

      Part of the dynamic here is that the PKI is so fragile that TOFU simply works better. It fails less often than TLS, which fails completely when a single CA misbehaves. TOFU isn't by any means perfect, but it's better than TLS and X.509 PKIs. It would be nice to have a PKI that works, but we don't.

      The middle ground I would like to get to is
      1) Everything establishes session keys on first use and key continuity, all the time. If there's identity authentication as well, then great, but don't make it requirement that gets in the way of running a link cipher.

      2) Identity authentication can happen before, at the time of or after first use.

      This way hardware and software can be built that encrypts by default without user involvement or understanding. Identity verification can be post-hoc applied if necessary and applied beforehand when it matters or people care enough.

      The technical details are endlessly fascinating and hard work.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    2. Re:MITM from day one by swillden · · Score: 1

      Part of the dynamic here is that the PKI is so fragile that TOFU simply works better.

      Cite? I seriously doubt that TOFU would actually work better if it were used on a large scale (SSH is *not* large scale). Key rotation is particularly problematic; by default TOFU just says "no" to key rotation, which is also bad. PKI + TOFU has interesting properties, but key rotation is still a problem.

      IMO, what would be best is PKI + Certificate Transparency + Convergence + (limited) TOFU. Marlinspike touts Convergence as an alternative to PKI, but I think it would work better as an additional layer. PKI works beautifully in the common case where CAs behave correctly and don't lose their keys. Adding Certificate Transparency covers the poor key management case (and would have identified these Symantec problems immediately), and Convergence provides further defense against MITM attacks. CT and Convergence server certs should be pinned, of course.

      And note that in most cases there's no reason your browser needs to delay the connection while it checks the additional layers. It can go ahead and establish the connection and begin downloading content while it checks with the CT and Convergence servers. It probably should defer rendering until it completes the additional checks, to protect against malicious content... unless it has already visited this site, and seen and checked this certificate (i.e. TOFU), in which case it can proceed with rendering. Though it should probably still check CT and Convergence in the background.

      It may seem like I'm suggesting just piling on layers, but each one of them addresses specific problems and each has specific tradeoffs.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
  39. Well, that explains things.... by sabbede · · Score: 1

    I was wondering why my cable company would be using an invalid certificate for the secure portions of their site. Now I know.

  40. Bwahahahaha: "Oh, I'm SO scared"... apk by Anonymous Coward · · Score: 0

    See subject: Why don't you just put yourself in a jail cell now? It's better than what I'd do to you (or my insurance company to you which might be a lot worse).

    * Of course that assumes you have any balls, & obviously based on your ac troll threats? You don't.

    APK

    P.S.=> Only a pussy does what you do (especially in "geek angst" after my last few posts splattered you all over /., lol, easily) weasel boy, lol... apk