Slashdot Mirror
'Here's Where Google Hid Chrome's SSL Certificate Information' (vortex.com)
"Google Chrome users have been contacting me wondering why they no longer could access the detailed status of Chrome https: connections, or view the organization and other data associated with SSL certificates for those connections," writes Slashdot reader Lauren Weinstein, adding "Google took a simple click in an intuitive place and replaced it with a bunch of clicks scattered around."
Up to now for the stable version of Chrome, you simply clicked the little green padlock icon on an https: connection, clicked on the "Details" link that appeared, and a panel then opened that gave you that status, along with an obvious button to click for viewing the actual certificate data such as Organization, issuance and expiration dates, etc. Suddenly, that "Details" link no longer is present...
The full certificate data is available from the "Developers tools" panel under the "Security" label. In fact, that's where this info has been for quite some time, but since the now missing "Details" link took you directly to that panel, most users probably didn't even realize that they were deep in the Developers tools section of the browser.
On some systems you can just press F12, but the alternate route is to click on the three vertical dots in the upper right, then select "More Tools", and then "Developer Tools". (And if you don't then see "Security", click on the " >>".)
The full certificate data is available from the "Developers tools" panel under the "Security" label. In fact, that's where this info has been for quite some time, but since the now missing "Details" link took you directly to that panel, most users probably didn't even realize that they were deep in the Developers tools section of the browser.
On some systems you can just press F12, but the alternate route is to click on the three vertical dots in the upper right, then select "More Tools", and then "Developer Tools". (And if you don't then see "Security", click on the " >>".)
v55 still has the "details" link.
It also applies to chromium >=56...
Present company not withstanding, probably less than 10% of users have any idea what a public key certificate is, who issues them and what a chain of trust is. Hiding this information from idiot users is acceptable if the browser also, by default, refuses to connect to HTTPS sites with expired certificates or certificates not issued by a trusted authority. If something is not right with the certificates the regular idiot user should get the big red warning page with the "Here be Dragons!" message.
Error: I should have said that Google Voice is free for calls to the U.S. & Canada.
You think they'd be able to hire good people for it.
I'd say "slow news days" but it's not like nothing is happening in the world right now.
Google "management"?
Think about the state of google's messaging platform(s). Then every other fuckup will be clear.
The "Details" link was replaced by a "Learn more" link, which leads to a less than useful Chrome Help page. That page lets you submit a comment as to how helpful the page is. If the "Learn more" link is not helpful in viewing the security certificate, we should leave a comment to tell them that.
Better than nothing, which is typical of most users.
Make it more difficult to check the security cert when I'm browsing. What bright spark at google came up with this idea?
"Just think how much money we'll save on tech support and development when the application doesn't do anything at all!"
It's called "alphabet" in an open and blatant reference to "alphabet agencies". It's for the people who didn't realize Google is an extension of the CIA, NSA, etc.
That's a bug right?
https://bugs.chromium.org/p/ch...
The average person, is not qualified to read or understand that tab about when it is secure and when it isnt. Hell, the average university masters graduate is not qualified to understand the information on the SSL security certificate.
I recon they are simplifying the browser security to make websites more ruthless in adhering to good security practices by punishing those admins who give their users a false sense of security.
2) More and more, Google software like Chrome and Android is getting a bad reputation for being invasive and destructive. The first comment in this story is "Chrome? People still use that spyware..?"
That reputation is among the very few that care about things like that. Regardless of which graph you look at, or who provides the data, Chrome use is still on a steady upwards trend meaning more people use it than ever. As for that first comment, well at least it lives up to the reputation of first comments. I wouldn't use it as a data point.
It's not possible to update Android on most phones, without risking bricking the phone.
That hasn't been true since gingerbread and nearly all vendors offer a nice auto upgrade process which reboots, does checks, applies the updates, and drops you right back where you left off. Actually I don't think I've ever heard of a case where an official update executed through proper normal channels has bricked a device, much less "most phones".
4) Perhaps 3 years ago, a Google manager told me that Google does not properly document what the company is doing.
This is essentially true for every company working on every project that isn't someway government related.
5) It was foolish for Google to adopt the name Alphabet [wikipedia.org].
Google is not Alphabet. Alphabet owns Google. No user will ever see Alphabet on a product or service page. The only people who will see Alphabet are investors, economists, and traders, and if they can't figure out which company they are looking at then maybe they should quit their day jobs and find something more suited to their mental capacity, like flipping burgers.
Why do good companies deteriorate? At one time, an employee of Google said the company should "Do no evil." Now Google apparently does evil when some not very clear-minded Google manager thinks, "Evil will make more money."
Only because people see what they want to see and take statements out of context, apply their own biases and pre-conceptions and then declare the company to be going against a direction the person themselves mentally created. Kind of like the "evil" thing. I've yet to see someone complain that "do no evil" doesn't apply, where there is actual "evil" involved.
They re only after your life, the universe and everything about you so that they can use it to send you adverts
That is their sole function in life these days.
Avoid them like the plague. Don't give them the keys to your life.
I have a 24 inch full hd screen. The UI seems to be optimized for a 5 inch handheld screen. Three dots, or three lines, sometimes nine dots, some times a gear sometimes something else, press and hold but sometimes press will be a click.... And on top of it the developers play where did they hide my cheese....
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Implying that there exists a user who's smart enough to read and understand the details of an SSL cert but is too dumb to open up the development tools by hitting F12?
People still use that spyware..?
More people now than ever with a user base that is still on a steady upwards trend.
But hey we get it. You're cool for calling it spyware bro.
> 1) Google maps says that Woodland, WA state is a few miles from St. Helens, OR state. But the Columbia River flows between those cities, and there is no bridge.
Google maps tells ME that you have to go all thev way up to Longview, 49 miles. Maybe you clicked the plane icon they used to have?
The rest of your points are all opinions and you're welcome to your opinion, of course. If those opinions are based on anything like your mistaken fact in point #1 ...
> They probably also could correlate people who use developer tools with people who would actually check the details of a security certificate.
Interesting theory. Google *is* all about correlation.
GP said invalid or expired certificates. If you want to use http (vs https), fine. You know it's not a secured connection.
If you use https with a certificate that can't be verified, you've not secured the connection, only pretended to. I can generate an (unvalidated) certificate for any of your hosts and mitm you, if you use unvalidated certs.
GP suggestion allows it be either be secure, or not secure, you just can't PRETEND that it's secure when it's really not.
It's not possible to update Android on most phones, without risking bricking the phone.
That hasn't been true since gingerbread and nearly all vendors offer a nice auto upgrade process which reboots, does checks, applies the updates, and drops you right back where you left off. Actually I don't think I've ever heard of a case where an official update executed through proper normal channels has bricked a device, much less "most phones".
I think the implication is that "most phones" don't have "an official update executed through proper normal channels" available at all. Therefore the only possibility to update is through CM or Lineage or what they're calling it now, and the installation process for that is what risks a brick.
Most unpleasant is this is this change having been done silently. When I click on padlock icon, no more hint where to look for that information.
Personally, I don't like software products that change interface etc. without even a short hint where to look for relocated information. it's not a rocket science to open Dev.tools, but hell, why should I solve that simple quest at all?
(a rhetoric question)
The Subject says it all..
And if you go to the security section in chrome and check the slashdot cert you see "and an obsolete cipher (AES_256_CBC with HMAC-SHA1)" ! So slashdot should really update to a better than sha1 certificate to be really secure!
mike c
Vivaldi browser provides just that described functionality when you click on the lock icon.
And if you go to the security section in chrome and check the slashdot cert you see "and an obsolete cipher (AES_256_CBC with HMAC-SHA1)" ! So slashdot should really update to a better than sha1 certificate to be really secure!
That may be the reason that they hid it. Naive users might get worried about this sort of warning. Of course SHA1 is still good enough for sites like Slashdot, nobody is going to use the immense computational time required to break SHA1 so that they can mess up your karma.
I think the implication is that "most phones" don't have "an official update executed through proper normal channels" available at all.
Then it would still be wrong. Every major Android manufacturer has an update process through official channels. The only exceptions are some of the stupid US specific carrier issues which cause one-off phone models to be created and have updates hampered by the carriers themselves.
The length that updates are available are a different question, but much like the very issue we are discussing, it has nothing to do with Google. We also don't blame Ubuntu when downstream forks/remxies aren't updated either. Google provides the updates, provides them in a timely way and provides an official channel. HTC (for a completely unsubstantiated example) not providing an update for the HTC One is entirely irrelevant when discussing Google management.
Every major Android manufacturer has an update process through official channels. The only exceptions are some of the stupid US specific carrier issues which cause one-off phone models to be created and have updates hampered by the carriers themselves.
For one thing, both Google and SlashdotMedia are headquartered in the US, making "US specific [...] issues" on-topic. For another, "carrier issues" don't explain why manufacturers of tablets can't manage to deliver usable updates. One reason is that newer Android versions tend to require more RAM and a faster, larger NAND. Upgrading a first-generation Nexus 7 tablet (Tegra 3, 1 GB RAM, 8 GB NAND) from Android 4.4 to 5.x, for example, leads to an unusably janky system with lag that often reaches five seconds. I've read rumors that this has something to do with disk-level encryption becoming enabled by default in newer versions of Android, and I guess part of the problem might be that encryption breaks data compression, which some NAND controllers use to improve write speed by fitting more logical sectors in each erase block.
We also don't blame Ubuntu when downstream forks/remxies aren't updated either.
We do when Canonical announces plans to remove from its repository the libraries needed for compatibility with Wine and other 32-bit applications, as it has announced for Ubuntu 18.10.
HTC (for a completely unsubstantiated example) not providing an update for the HTC One is entirely irrelevant when discussing Google management.
In theory, Google has the power under copyright to require licensees of the proprietary Google Play Store application to offer Android OS updates for however many months.
You have no idea what you're talking about, and probably a good example of why they hid this information away
Slashdot is using a certificate with a SHA-256 signature. You are talking about the encryption cipher the webserver is using, which has been superseded, but is not yet considered a security risk.