Slashdot Mirror
Symantec Explores Selling Web Certificates Business (reuters.com)
Cybersecurity firm Symantec is considering selling its website certification business, in a deal that could fetch more than $1 billion and extricate it from a feud with Alphabet's Google, people familiar with the matter told Reuters. From a report: Google said in March that it was investigating Symantec's failure to properly validate its certificates, which confirm that websites can be trusted. Symantec has called Google's claims "exaggerated and misleading." Symantec is in talks with a small number of companies and private equity firms about the potential sale, three sources said, asking not to be identified because the matter is confidential. There is no certainty that a deal will occur, the sources added.
I think Symantec should sell to Kaspersky.
What's left after selling that off? Mediocre antivirus?
Fixing it before selling it would get them a little better deal. At this rate, they're heading for a Yahoo-style fire sale with that unit despite their supposed valuation in the article.
I think they should sell to Cisco. That way you can't tell if you've been MITM or not.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
SSL Certificates is all about trust. If, as a cert authority, you violate that trust in *any* way, then you shouldn't be allowed to sell certificates anymore.
It's destressing the companies like Symantec (and Comodo for that matter) are still in the certificate authority business despite their multiple massive screwups.
So far this calendar year, Symantec has had at least two failures in its operations, failures that had the possibility of creating significant security vulnerabilities for end-users. Mozilla has demanded that Symantec remedy the situation, with Mozilla requiring a clear schedule for implementing the remedies.
Symantec certificate validation was also developed by the famous symantec anti-virus team. One certificate validation required one day CPU of a whole data center. So they decided to lighten the process.
Slashdot, fix the reply notifications... You won't get away with it...
Marissa Mayer should run this business. She might have better luck than Yahoo.
Maybe Symantec is just trying to get out of the market ahead of the LetsEncrypt announcement that wildcard domain certificates would be available for free shortly. Once your trustworthiness is questioned, that might be the best thing to do.
I admit that I'm pretty much a newbie on public certificates, having spent most of my career in non-web parts of IT. But, isn't the point of buying a certificate from a "real" CA the fact that you can show your customers that the CA took steps to prove your company is your company? And by extension, since your company's cert is issued by a CA that my browser trusts, then there has to be some validation done by the CA. I just went through the process of getting an EV certificate for a project we're working on, and the CA we used certainly spent some effort verifying my company's publically-available information, my employment information and authority to represent the organization before they'd give me the certificate. If a CA gets a reputation for shortcutting this process, or plays fast and loose with how they store their private keys to their issuing certs, then that's the real-world equivalent of a country issuing passports without checking if someone shows up in the country's birth records.
Anyone can stand up a certificate authority and hand out certificates. We (and most other companies with big IT infrastructure) are doing it internally, but the difference is that some browser coming in from the Internet doesn't recognize our internal CA as a trusted root CA. I guess if LetsEncrypt is handing out certificates for free, CAs that can't guarantee they're offering something more trustworthy than that aren't going to be able to charge for issuing little 30K files anymore. LE is certainly going to disrupt the Domain Validation end of the certificate market because there will be a ubiquitous, free and easy way to get certificates -- it's essentially enabling basic SSL/TLS for everyone by getting rid of the cost factor. Whether this eats up the EV side of the market too remains to be seen - users don't typically care whether there's a lock icon in the browser bar or what color it is.
Symantecs original idea behind the certificate authority business itself, was to create an out of the box condition for its bluecoat product to work in any environment. bluecoat does TLS termination/snooping and as such requres extensive work in corporate PKI to inject trusted certs into the browser trust and cert trust for machines.
having a publically trusted CA that could -- out of the box -- be used to intercept traffic by a popular piece of hardware thats been sold to iran and syria is likely that made google furious. Its also worth considering that Symantec considered a PKI authority to be just another "business acquisition" that would fly under the radar, only to be confronted with a voraciously defensive internet that was working to ensure TLS could not be tampered with.
ultimately, google started fishing for legitimate RFC and industry based reasons to blackball their CA. Symantec is likely getting exhausted by all the auditing and security required to maintain what was, after all, originally just intended to help customers who want to snoop on their employees and citizens
Good people go to bed earlier.
I'm sure this has nothing to do with Let's Encrypt and Domain Validated Certificates being passed out for free. The market is changing and Symantec is looking for a sucker with a billion dollars.
others did not
who do you trust again?
If only DANE TLSA were implemented, then we wouldn't be having this conversation. Everyone would run their own CA and the question of public CAs would be moot.
They should just sell their crypto operation to WoSign. -PCP
WTF? Looks like the article's authors (Liana B. Baker and Greg Roumeliotis) don't even know what a certificate does. But they're writing about it.
If only Reuters had a certificate, then we'd know they can be trusted to understand what they write about!
Who would want so spend money on this before Google has ruled it clean? If Chrome cease to trust Symantec CA, its value drops to zero.
So Google, via Chrome, is dropping the axe on Verisgn (not quite as badly as WoSign), so Symantec is dropping it like a flaming bag of shit.
Why not dump it on ICANN...