Feeds

Chrome to weed out dodgy website SSL certificates by itself

Ditched online checks like 'seat belt that snaps when you crash'

Securing Web Applications Made Simple and Scalable

Google will drop online checks for revoked website encryption certificates in future versions of its Chrome browser after it decided that the process no longer offers any tangible benefits.

For about a decade now, browsers check the validity of a website's secure sockets layer (SSL) certificate by polling online revocation databases when a user attempts to connect to a secure HTTPS server. A certificate could be cancelled by a Certificate Authority (CA), and thus wind up on a certificate revocation list, if it was faulty or compromised in some way. Cancelling a certificate, or failing to validate it, should therefore warn the visitor to be wary of the site.

However browsers will still establish a connection even if this validation process fails. This behaviour is needed in case users attempt to connect from within heavily firewalled networks, such as public Wi-Fi hotspots and corporate environments: punters might have to sign into an HTTPS site while traffic to other services, including the CAs' verification servers via the online certificate status protocol, are blocked.

Halting access to a HTTPS-secured website if a revocation check failed would leave users unable to connect to sites if the relevant CA was down for any reason, another bad idea.

The problem is that hackers can use a variety of tricks to cause the revocation checks to fail, something that would be ignored in the same way as if a CA was down or a user was signing into a Wi-Fi hotspot.

Google software developer Adam Langley compared such "soft-fail revocation checks" in this scenario to a "seat-belt that snaps when you crash". He argued: "Even though it works 99 per cent of the time, it's worthless because it only works when you don't need it."

SSL revocation checks also provide a false sense of assurance because attackers capable of spoofing websites and forging certificate credentials are also more than capable of replacing the warning that a certificate is invalid. In addition, ordinary users typically ignore such warnings.

Bringing SSL certificate checks in-house

"While the benefits of online revocation checking are hard to find, the costs are clear: online revocation checks are slow and compromise privacy," Langley explains in a blog post. Checks can make SSL pages slower to load and create a potential means for CAs to compile logs of user IP addresses and the sites they visit - a privacy risk in itself.

Instead of relying on online certificate revocation list checks, future versions of Chrome will instead use an update mechanism to maintain the list within Chrome itself. This will become the norm but Google hasn't decide whether to ditch these online certification revocation checks entirely.

"There is a class of higher-security certificate, called an EV [Extended Validation] certificate, where we haven't made a decision about what to do yet," Langely explains.

Browser vendors in general responded to last year's DigiNotar hack by revoking certificates from the firm via a browser-based software update. Langely is proposing a more lighter weight method of revoking certificates so that lists can be updated on the fly, without requiring a software update.

"Our current method of revoking certificates in response to major incidents is to push a software update," Langely writes. "Microsoft, Opera and Firefox also push software updates for serious incidents rather than rely on online revocation checks. But our software updates require that users restart their browser before they take effect, so we would like a lighter weight method of revoking certificates."

It's unclear over what timescale Google intends to introduce the certification revocation check changes but a spokesman for the web giant said that this would probably happen over a matter of months. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.