Google Online Security Blog: 10月 2015

Security Blog

The latest news and insights from Google on security and safety on the Internet

Sustaining Digital Certificate Security

2015年10月28日

Posted by Ryan Sleevi, Software EngineerThis post updates our previous notification of a misissued certificate for google.coma report164 certificates2,458 certificates

A post-mortem analysis that details why they did not detect the additional certificates that we found.

Details of each of the failures to uphold the relevant Baseline Requirements and EV Guidelines and what they believe the individual root cause was for each failure.

Following the implementation of these corrective steps, we expect Symantec to undergo a Point-in-time Readiness Assessment and a third-party security audit. The point-in-time assessment will establish Symantec’s conformance to each of these standards:

WebTrust Principles and Criteria for Certification Authorities
WebTrust Principles and Criteria for Certification Authorities – SSL Baseline with Network Security
WebTrust Principles and Criteria for Certification Authorities – Extended Validation SSL

The third-party security audit must assess:

The veracity of Symantec’s claims that at no time private keys were exposed to Symantec employees by the tool.
That Symantec employees could not use the tool in question to obtain certificates for which the employee controlled the private key.
That Symantec’s audit logging mechanism is reasonably protected from modification, deletion, or tampering, as described in Section 5.4.4 of their CPS.

We may take further action as additional information becomes available to us.

Google

Behind the red warning: more info about online site safety

2015年10月20日

Posted by Adrienne Porter Felt, Chrome Security Engineer and Warning WizardEmily Schechter, Safe Browsing Program Manager and Menace to MalwareKe Wang, Safe Browsing Engineer and Developer of DefenseSite Status sectionSafe Browsing diagnostic pageunwanted software

Search ConsoleGoogle Analyticshelp centerTransparency Report

Google

Simplifying the Page Security Icon in Chrome

2015年10月13日

Posted by Lucas Garron and Chris Palmer, Chrome security team

There are two reasons for this:

This change is a better visual indication of the security state of the page relative to HTTP.

Chrome users will have fewer security states to learn.

(Not) Warning About Mixed Content
This change will mainly affect HTTPS pages that contain certain mixed content, such as HTTP images.
Site operators face a dilemma: Switching an HTTP site to HTTPS can initially result in mixed content, which is undesirable in the long term but important for debugging the migration. During this process the site may not be fully secured, but it will usually not be less secure than before.
Removing the yellow “caution triangle” badge means that most users will not perceive a warning on mixed content pages during such a migration. We hope that this will encourage site operators to switch to HTTPS sooner rather than later.
Fewer Security States
This change will reduce the number of page security states in Chrome from four to three.
We have to strike a balance: representing the security state of a webpage as accurately as possible, while making sure users are not overwhelmed with too many possible states and details. We’ve come to understand that our yellow “caution triangle” badge can be confusing when compared to the HTTP page icon, and we believe that it is better not to emphasize the difference in security between these two states to most users. For developers and other interested users, it will still be possible to tell the difference by checking whether the URL begins with “https://”.
In the long term, we hope that most sites on the internet will become secure, and we plan to reduce the icon to just two states: secure and not secure. The change announced in this post is a small step in that direction.

Google

Feed

Give us feedback in our Product Forums.

Google
Privacy
Terms

Security Blog

Sustaining Digital Certificate Security

Behind the red warning: more info about online site safety

Simplifying the Page Security Icon in Chrome

標籤

Archive

Feed