Feeds

Chrome to weed out dodgy website SSL certificates by itself

Ditched online checks like 'seat belt that snaps when you crash'

Internet Security Threat Report 2014

Google will drop online checks for revoked website encryption certificates in future versions of its Chrome browser after it decided that the process no longer offers any tangible benefits.

For about a decade now, browsers check the validity of a website's secure sockets layer (SSL) certificate by polling online revocation databases when a user attempts to connect to a secure HTTPS server. A certificate could be cancelled by a Certificate Authority (CA), and thus wind up on a certificate revocation list, if it was faulty or compromised in some way. Cancelling a certificate, or failing to validate it, should therefore warn the visitor to be wary of the site.

However browsers will still establish a connection even if this validation process fails. This behaviour is needed in case users attempt to connect from within heavily firewalled networks, such as public Wi-Fi hotspots and corporate environments: punters might have to sign into an HTTPS site while traffic to other services, including the CAs' verification servers via the online certificate status protocol, are blocked.

Halting access to a HTTPS-secured website if a revocation check failed would leave users unable to connect to sites if the relevant CA was down for any reason, another bad idea.

The problem is that hackers can use a variety of tricks to cause the revocation checks to fail, something that would be ignored in the same way as if a CA was down or a user was signing into a Wi-Fi hotspot.

Google software developer Adam Langley compared such "soft-fail revocation checks" in this scenario to a "seat-belt that snaps when you crash". He argued: "Even though it works 99 per cent of the time, it's worthless because it only works when you don't need it."

SSL revocation checks also provide a false sense of assurance because attackers capable of spoofing websites and forging certificate credentials are also more than capable of replacing the warning that a certificate is invalid. In addition, ordinary users typically ignore such warnings.

Bringing SSL certificate checks in-house

"While the benefits of online revocation checking are hard to find, the costs are clear: online revocation checks are slow and compromise privacy," Langley explains in a blog post. Checks can make SSL pages slower to load and create a potential means for CAs to compile logs of user IP addresses and the sites they visit - a privacy risk in itself.

Instead of relying on online certificate revocation list checks, future versions of Chrome will instead use an update mechanism to maintain the list within Chrome itself. This will become the norm but Google hasn't decide whether to ditch these online certification revocation checks entirely.

"There is a class of higher-security certificate, called an EV [Extended Validation] certificate, where we haven't made a decision about what to do yet," Langely explains.

Browser vendors in general responded to last year's DigiNotar hack by revoking certificates from the firm via a browser-based software update. Langely is proposing a more lighter weight method of revoking certificates so that lists can be updated on the fly, without requiring a software update.

"Our current method of revoking certificates in response to major incidents is to push a software update," Langely writes. "Microsoft, Opera and Firefox also push software updates for serious incidents rather than rely on online revocation checks. But our software updates require that users restart their browser before they take effect, so we would like a lighter weight method of revoking certificates."

It's unclear over what timescale Google intends to introduce the certification revocation check changes but a spokesman for the web giant said that this would probably happen over a matter of months. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.