Gmail certificate expiry snafu follows security upgrade
Webmail service POP losses its fizzle
Customer Success Testimonial: Recovery is Everything
Update Google allowed one of its Gmail SSL certificates to expire days after promising users improved webmail security.
Because Google's certificate for IMAP/POP traffic expired on Tuesday users were confronted by a potentially confusing "invalid certificate" warning. In some cases users may also have been left unable to send email. Google fixed the problem within hours on Tuesday afternoon (US time).
The snafu comes less than a week after Gmail improved security by making sure users of the popular web mail service go through a secure connection each time they access their account online.
Forgetting to renew a digital certificate can happen to any organisation, as Microsoft and HSBC (among many others) are able to testify. Even though a certificate is out of date a secure connection with a site can still be established. Google makes it its business to index all the world's data so its own failure to manage a key domain is an embarrassing faux pas even though no harm, or much inconvenience, was caused.
Reg reader Peter Houppermans, who brought the slip-up to our attention, drily notes that users are now so well trained to blithely click on past invalid certificates, so that this sort of thing should present no great problem. ®
COMMENTS
business impact of expired certs
While I doubt anyone will loose faith in Google's ability to secure our data and/or gmail, expired certs and the ensuing security pop-up alerts do impact consumer behavior. Over time users become conditioned to the alerts and simply begin to ignore them. This is certainly not a security best practice, especially as phishing scams abound.
Check out some compelling survey results on this topic at: http://www.venafi.com/Collateral_Library/VenafiEncryptionStudy2007.pdf
Why aren't Google issuing their own certificates?
They couldn't do a worse job than the Veri$ign monopoly (which includes Thawte and Geotrust).
Invalid certs
Are only a problem if the data one is transferring is important. Half the time, it's SSL security guarding registration details when I don't care about registering. Like the Microsoft site, for instance.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
