Slashdot Mirror
'Here's Where Google Hid Chrome's SSL Certificate Information' (vortex.com)
"Google Chrome users have been contacting me wondering why they no longer could access the detailed status of Chrome https: connections, or view the organization and other data associated with SSL certificates for those connections," writes Slashdot reader Lauren Weinstein, adding "Google took a simple click in an intuitive place and replaced it with a bunch of clicks scattered around."
Up to now for the stable version of Chrome, you simply clicked the little green padlock icon on an https: connection, clicked on the "Details" link that appeared, and a panel then opened that gave you that status, along with an obvious button to click for viewing the actual certificate data such as Organization, issuance and expiration dates, etc. Suddenly, that "Details" link no longer is present...
The full certificate data is available from the "Developers tools" panel under the "Security" label. In fact, that's where this info has been for quite some time, but since the now missing "Details" link took you directly to that panel, most users probably didn't even realize that they were deep in the Developers tools section of the browser.
On some systems you can just press F12, but the alternate route is to click on the three vertical dots in the upper right, then select "More Tools", and then "Developer Tools". (And if you don't then see "Security", click on the " >>".)
The full certificate data is available from the "Developers tools" panel under the "Security" label. In fact, that's where this info has been for quite some time, but since the now missing "Details" link took you directly to that panel, most users probably didn't even realize that they were deep in the Developers tools section of the browser.
On some systems you can just press F12, but the alternate route is to click on the three vertical dots in the upper right, then select "More Tools", and then "Developer Tools". (And if you don't then see "Security", click on the " >>".)
v55 still has the "details" link.
It also applies to chromium >=56...
Present company not withstanding, probably less than 10% of users have any idea what a public key certificate is, who issues them and what a chain of trust is. Hiding this information from idiot users is acceptable if the browser also, by default, refuses to connect to HTTPS sites with expired certificates or certificates not issued by a trusted authority. If something is not right with the certificates the regular idiot user should get the big red warning page with the "Here be Dragons!" message.
Oil and water.
We are seeing a lot of instances of sloppy, insufficient Google management. Here are some:
1) Google maps says that Woodland, WA state is a few miles from St. Helens, OR state. But the Columbia River flows between those cities, and there is no bridge. I gave feedback about that perhaps 2 years ago. Maybe no one reads the feedback.
2) More and more, Google software like Chrome and Android is getting a bad reputation for being invasive and destructive. The first comment in this story is "Chrome? People still use that spyware..?"
I used Chrome a long time ago. I uninstalled it when I realized it installed 3 system services.
It's not possible to update Android on most phones, without risking bricking the phone. Abusive phone companies want you to buy another phone with a 2-year contract; they don't want updates. Google allows the bad reputation.
3) Google Voice is a wonderful free service. Only 1 cent per minute to call Brazil! But the woman who writes the documentation, "Megan", obviously has no technical knowledge, and no interest in full understanding. The Google Voice user interface has hidden flaws; no one is fixing them, apparently.
4) Perhaps 3 years ago, a Google manager told me that Google does not properly document what the company is doing. She said it is difficult or impossible for Google employees to follow the progress of their company.
5) It was foolish for Google to adopt the name Alphabet. Every time someone sees the name, it is necessary to realize it's not about an alphabet.
6) There are many more areas of poor and sloppy management at Google, now Alphabet, but that's enough for now.
Why do good companies deteriorate? At one time, an employee of Google said the company should "Do no evil." Now Google apparently does evil when some not very clear-minded Google manager thinks, "Evil will make more money."
Error: I should have said that Google Voice is free for calls to the U.S. & Canada.
It's who APPROVED the developer's work.
Fault? Not if the goddamned entire thing is planned, meeting'd to death, and signed off a dozen times over.
You think they'd be able to hire good people for it.
I'd say "slow news days" but it's not like nothing is happening in the world right now.
The "Details" link was replaced by a "Learn more" link, which leads to a less than useful Chrome Help page. That page lets you submit a comment as to how helpful the page is. If the "Learn more" link is not helpful in viewing the security certificate, we should leave a comment to tell them that.
Better than nothing, which is typical of most users.
Make it more difficult to check the security cert when I'm browsing. What bright spark at google came up with this idea?
"Just think how much money we'll save on tech support and development when the application doesn't do anything at all!"
That's a bug right?
https://bugs.chromium.org/p/ch...
The average person, is not qualified to read or understand that tab about when it is secure and when it isnt. Hell, the average university masters graduate is not qualified to understand the information on the SSL security certificate.
I recon they are simplifying the browser security to make websites more ruthless in adhering to good security practices by punishing those admins who give their users a false sense of security.
In many enterprise environments the developer tools are disabled via group policy. This change means many users who may want to view this information now will no longer be able to. Considering how enterprise security teams are always trying to educate users on safety this simple check now cannot be done.
They re only after your life, the universe and everything about you so that they can use it to send you adverts
That is their sole function in life these days.
Avoid them like the plague. Don't give them the keys to your life.
I have a 24 inch full hd screen. The UI seems to be optimized for a 5 inch handheld screen. Three dots, or three lines, sometimes nine dots, some times a gear sometimes something else, press and hold but sometimes press will be a click.... And on top of it the developers play where did they hide my cheese....
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Who needs to verify certificates, if you can just put all malware sites into a hosts file?
So several domains of a business I run recently needed new certificates. I always like to make sure everything looks proper after I make a change like that. I hadn't used Chrome in a while and spent a good hour of time trying to figure out how to view what Chrome thought of my certificate. I figured this was a change Google did a while ago but I guess it's recent breakage.
Google has jumped the shark long ago. They are the new Microsoft. Amusingly Microsoft is now the company following standards and doing the right thing. Go figure.
At least Google DNS hasn't been fucked up yet. Still the fastest in my location, according to GRC's DNSBench.
Implying that there exists a user who's smart enough to read and understand the details of an SSL cert but is too dumb to open up the development tools by hitting F12?
People still use that spyware..?
More people now than ever with a user base that is still on a steady upwards trend.
But hey we get it. You're cool for calling it spyware bro.
> 1) Google maps says that Woodland, WA state is a few miles from St. Helens, OR state. But the Columbia River flows between those cities, and there is no bridge.
Google maps tells ME that you have to go all thev way up to Longview, 49 miles. Maybe you clicked the plane icon they used to have?
The rest of your points are all opinions and you're welcome to your opinion, of course. If those opinions are based on anything like your mistaken fact in point #1 ...
> They probably also could correlate people who use developer tools with people who would actually check the details of a security certificate.
Interesting theory. Google *is* all about correlation.
GP said invalid or expired certificates. If you want to use http (vs https), fine. You know it's not a secured connection.
If you use https with a certificate that can't be verified, you've not secured the connection, only pretended to. I can generate an (unvalidated) certificate for any of your hosts and mitm you, if you use unvalidated certs.
GP suggestion allows it be either be secure, or not secure, you just can't PRETEND that it's secure when it's really not.
Most unpleasant is this is this change having been done silently. When I click on padlock icon, no more hint where to look for that information.
Personally, I don't like software products that change interface etc. without even a short hint where to look for relocated information. it's not a rocket science to open Dev.tools, but hell, why should I solve that simple quest at all?
(a rhetoric question)
And you don't think it is.... tell us more, cool bro.
Does anyone actually use the I'm feeling lucky button?
The Subject says it all..
And if you go to the security section in chrome and check the slashdot cert you see "and an obsolete cipher (AES_256_CBC with HMAC-SHA1)" ! So slashdot should really update to a better than sha1 certificate to be really secure!
mike c
Vivaldi browser provides just that described functionality when you click on the lock icon.
And if you go to the security section in chrome and check the slashdot cert you see "and an obsolete cipher (AES_256_CBC with HMAC-SHA1)" ! So slashdot should really update to a better than sha1 certificate to be really secure!
That may be the reason that they hid it. Naive users might get worried about this sort of warning. Of course SHA1 is still good enough for sites like Slashdot, nobody is going to use the immense computational time required to break SHA1 so that they can mess up your karma.
Every major Android manufacturer has an update process through official channels. The only exceptions are some of the stupid US specific carrier issues which cause one-off phone models to be created and have updates hampered by the carriers themselves.
For one thing, both Google and SlashdotMedia are headquartered in the US, making "US specific [...] issues" on-topic. For another, "carrier issues" don't explain why manufacturers of tablets can't manage to deliver usable updates. One reason is that newer Android versions tend to require more RAM and a faster, larger NAND. Upgrading a first-generation Nexus 7 tablet (Tegra 3, 1 GB RAM, 8 GB NAND) from Android 4.4 to 5.x, for example, leads to an unusably janky system with lag that often reaches five seconds. I've read rumors that this has something to do with disk-level encryption becoming enabled by default in newer versions of Android, and I guess part of the problem might be that encryption breaks data compression, which some NAND controllers use to improve write speed by fitting more logical sectors in each erase block.
We also don't blame Ubuntu when downstream forks/remxies aren't updated either.
We do when Canonical announces plans to remove from its repository the libraries needed for compatibility with Wine and other 32-bit applications, as it has announced for Ubuntu 18.10.
HTC (for a completely unsubstantiated example) not providing an update for the HTC One is entirely irrelevant when discussing Google management.
In theory, Google has the power under copyright to require licensees of the proprietary Google Play Store application to offer Android OS updates for however many months.
You have no idea what you're talking about, and probably a good example of why they hid this information away
Slashdot is using a certificate with a SHA-256 signature. You are talking about the encryption cipher the webserver is using, which has been superseded, but is not yet considered a security risk.
Works fine for me. Only a fool updates their browser.
CAP === 'schools'