Feeds

Chrome to weed out dodgy website SSL certificates by itself

Ditched online checks like 'seat belt that snaps when you crash'

Protecting against web application threats using SSL

Google will drop online checks for revoked website encryption certificates in future versions of its Chrome browser after it decided that the process no longer offers any tangible benefits.

For about a decade now, browsers check the validity of a website's secure sockets layer (SSL) certificate by polling online revocation databases when a user attempts to connect to a secure HTTPS server. A certificate could be cancelled by a Certificate Authority (CA), and thus wind up on a certificate revocation list, if it was faulty or compromised in some way. Cancelling a certificate, or failing to validate it, should therefore warn the visitor to be wary of the site.

However browsers will still establish a connection even if this validation process fails. This behaviour is needed in case users attempt to connect from within heavily firewalled networks, such as public Wi-Fi hotspots and corporate environments: punters might have to sign into an HTTPS site while traffic to other services, including the CAs' verification servers via the online certificate status protocol, are blocked.

Halting access to a HTTPS-secured website if a revocation check failed would leave users unable to connect to sites if the relevant CA was down for any reason, another bad idea.

The problem is that hackers can use a variety of tricks to cause the revocation checks to fail, something that would be ignored in the same way as if a CA was down or a user was signing into a Wi-Fi hotspot.

Google software developer Adam Langley compared such "soft-fail revocation checks" in this scenario to a "seat-belt that snaps when you crash". He argued: "Even though it works 99 per cent of the time, it's worthless because it only works when you don't need it."

SSL revocation checks also provide a false sense of assurance because attackers capable of spoofing websites and forging certificate credentials are also more than capable of replacing the warning that a certificate is invalid. In addition, ordinary users typically ignore such warnings.

Bringing SSL certificate checks in-house

"While the benefits of online revocation checking are hard to find, the costs are clear: online revocation checks are slow and compromise privacy," Langley explains in a blog post. Checks can make SSL pages slower to load and create a potential means for CAs to compile logs of user IP addresses and the sites they visit - a privacy risk in itself.

Instead of relying on online certificate revocation list checks, future versions of Chrome will instead use an update mechanism to maintain the list within Chrome itself. This will become the norm but Google hasn't decide whether to ditch these online certification revocation checks entirely.

"There is a class of higher-security certificate, called an EV [Extended Validation] certificate, where we haven't made a decision about what to do yet," Langely explains.

Browser vendors in general responded to last year's DigiNotar hack by revoking certificates from the firm via a browser-based software update. Langely is proposing a more lighter weight method of revoking certificates so that lists can be updated on the fly, without requiring a software update.

"Our current method of revoking certificates in response to major incidents is to push a software update," Langely writes. "Microsoft, Opera and Firefox also push software updates for serious incidents rather than rely on online revocation checks. But our software updates require that users restart their browser before they take effect, so we would like a lighter weight method of revoking certificates."

It's unclear over what timescale Google intends to introduce the certification revocation check changes but a spokesman for the web giant said that this would probably happen over a matter of months. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.