Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Google will drop online checks for revoked website encryption certificates in future versions of its Chrome browser after it decided that the process no longer offers any tangible benefits.

For about a decade now, browsers check the validity of a website's secure sockets layer (SSL) certificate by polling online revocation databases when a user attempts to connect to a secure HTTPS server. A certificate could be cancelled by a Certificate Authority (CA), and thus wind up on a certificate revocation list, if it was faulty or compromised in some way. Cancelling a certificate, or failing to validate it, should therefore warn the visitor to be wary of the site.

Halting access to a HTTPS-secured website if a revocation check failed would leave users unable to connect to sites if the relevant CA was down for any reason, another bad idea.

The problem is that hackers can use a variety of tricks to cause the revocation checks to fail, something that would be ignored in the same way as if a CA was down or a user was signing into a Wi-Fi hotspot.

Google software developer Adam Langley compared such "soft-fail revocation checks" in this scenario to a "seat-belt that snaps when you crash". He argued: "Even though it works 99 per cent of the time, it's worthless because it only works when you don't need it."

SSL revocation checks also provide a false sense of assurance because attackers capable of spoofing websites and forging certificate credentials are also more than capable of replacing the warning that a certificate is invalid. In addition, ordinary users typically ignore such warnings.

Bringing SSL certificate checks in-house

"While the benefits of online revocation checking are hard to find, the costs are clear: online revocation checks are slow and compromise privacy," Langley explains in a blog post. Checks can make SSL pages slower to load and create a potential means for CAs to compile logs of user IP addresses and the sites they visit - a privacy risk in itself.

Instead of relying on online certificate revocation list checks, future versions of Chrome will instead use an update mechanism to maintain the list within Chrome itself. This will become the norm but Google hasn't decide whether to ditch these online certification revocation checks entirely.

"There is a class of higher-security certificate, called an EV [Extended Validation] certificate, where we haven't made a decision about what to do yet," Langely explains.

Browser vendors in general responded to last year's DigiNotar hack by revoking certificates from the firm via a browser-based software update. Langely is proposing a more lighter weight method of revoking certificates so that lists can be updated on the fly, without requiring a software update.

"Our current method of revoking certificates in response to major incidents is to push a software update," Langely writes. "Microsoft, Opera and Firefox also push software updates for serious incidents rather than rely on online revocation checks. But our software updates require that users restart their browser before they take effect, so we would like a lighter weight method of revoking certificates."

It's unclear over what timescale Google intends to introduce the certification revocation check changes but a spokesman for the web giant said that this would probably happen over a matter of months. ®

Agentless Backup is Not a Myth