Hacker News Reader

Comment by inetknght | Hacker News Reader

The fact that I have to open developer tools to inspect the cert on Chrome is infuriating.

I'm reminded of a Torvalds quote from about a decade ago:

> This 'users are idiots, and are confused by functionality' mentality of Gnome is a disease. If you think your users are idiots, only idiots will use it.

For clarity, the feature isn't removed. You open the developer console (it has like nine keys bound to do this, F12 is the easiest), select the "security" tab, then hit the "view certificate" button.

I buy that this isn't as easy as the old mechanism (click on the TLS lock icon next to the URL) but...

But the point was/is to get "normal" users to pay attention. This just buries those details further away.

In the last few years, I've been somewhat pleasantly surprised at how much more attention my non-tech friends and acquaintances are paying to the topic of security.

No, they don't have it all figured out. But they are aware, and they are demonstrating some "pause and check".

How nice it would be to be able to point them to an obvious and straight-forward representation/presentation of the cert chain.

Instead, we get continued fussing with the "lock UI" and further and further hiding away of the relevant details.

Boo.

Didn't know about F12 - thanks for the tip!

What are the other keys? I know about F12, but I have it mapped to something else. I'm using Gnome.

Any of Ctrl-Shift-{c,i,j} will pop up various tabs of the developer tools. There may be others I'm not aware of.

+1 Vote for them to revert it here: https://bugs.chromium.org/p/chromium/issues/detail?id=663971

Yes, it is infuriating. I didn't even realize it was in the dev tools until today. I thought they'd just dropped the functionality altogether.

The dev tools are nice, and I like using the multiple profiles for both dev (logging in as multiple users) and segregating my banking cookies. Otherwise I'd drop chrome for safari.

(I also wish they'd expose certificate metadata to plugins, so I could write my own cert checking/pinning code.)

It was one of those minor chrome changes that shouldn't bother me, but ends up driving me slightly insane.

The dumbing down of Chrome is seriously driving me away. There used to be a ton of power-user-friendly options easily available. Now they're all hidden in favor of simplicity.

My brother's been recommending Opera for a long time. I think it's time I listened to him and gave it a try.

There's a big difference in attitudes between browsers here.

Take OCSP for example - Chrome disabled OCSP because in optional mode it wasn't a perfect solution and they didn't want to enable it in required mode because that could confuse the poor users. After the heartbleed attack, Chrome was only able to bundle a tiny fraction of the certificates into their CRLs - leaving millions of domains still vulnerable to blacklisted certificates. On Chrome - you're just screwed, there's no way to turn OCSP into required mode to prevent such attacks.

On Firefox however you're able to force OCSP required - making it actually useful if you're sophisticated enough to understand what a failure of it may mean and you're actually able to blacklist all of those certificates. A huge security benefit in such a case.

Edit: I'm wrong. Removing this comment regarding why certificate revocation checking is still useful, because someone pointed out you can create a new account to get a new certificate from a CA, and I didn't realize it was that easy to just sign up for a new account. (I was thinking of EV certificates mostly so I didn't think of this attack vector at all.) See [1] for background.

Thanks all for pointing that out.

[1] https://www.imperialviolet.org/2014/04/19/revchecking.html

I think he's actually right about the attacker being near you most of the time - compromising a data center is much harder than compromising a LAN most of the time.

However, he completely ignores the fact that some users may be sophisticated enough the handle the hard-fail scenarios mentioned. Well, I am. And so are many others. So what am I supposed to do if I want security and can handle hard-fails?

Not use Chrome seems to be the answer. Chrome fails to account for power users and developers who would rather have improved security and functionality.

What's your alternative? A customized Chromium fork? Every other browser is markedly less secure than Chrome. If exploit resilience is all you care about, you can theoretically use Edge, but now you're throwing away a lot of important TLS policy stuff that Chrome does and Microsoft is years behind on.

Firefox - they're years ahead on this sort of stuff. Their about:config gives you immense power to configure your browser to behave exactly how you want it to. Unlike any other browser around really.

The flexibility this brings you in privacy gains alone is immense. Just try to do something as basic as turn off WebRTC in Chrome and you'll see what I'm talking about. Firefox is the only viable answer if you care about privacy and security and have the ability to take things into your own hands.

Virtually nobody who works in browser security agrees with you about that. There are privacy wins to be had with Firefox, but they come at the expense of security.

> And to install a specially formed page on the site, you still need to be able to GET a copy of that page to install in the first place, and how the hell are you going to do that without ALSO stealing their CA login credentials, which I'm pretty damn sure will NOT be stored on every single random server you hack?

The ability to answer arbitrary HTTP requests on a server is sufficient to get a publicly-trusted certificate from any number of CAs. You do not need the credentials for the CA they've been using. Just create a new account. Future extensions for the DNS CAA record[1] might be able to help against this if you keep your credentials away from your web server.

[1]: https://datatracker.ietf.org/doc/html/draft-ietf-acme-caa

> The ability to answer arbitrary HTTP requests on a server is sufficient to get a publicly-trusted certificate from any number of CAs.

I'm saying you have to know what response to GIVE, don't you? You can't just give a random response...

The CA tells you what response to give on that new account you signed up.

Thanks, that didn't occur to me since I was mostly thinking of EV certs for some reason.

There's nothing to stop you from creating a new account at the CA of your choice, asking for a validation token, and putting it wherever it needs to be.

Without widespread adoption of a must-staple extension, OCSP is cosmetic. The decision to disable it didn't come from simplicity fascists; it came from people like Adam Langley. AGL isn't right about everything, but if you take the position that something he does with Chrome TLS is ludicrous, my default will be that you don't understand the issue as well as he does.

> Without widespread adoption of a must-staple extension, OCSP is cosmetic. The decision to disable it didn't come from simplicity fascists; it came from people like Adam Langley. AGL isn't right about everything, but if you take the position that something he does with Chrome TLS is ludicrous, my default will be that you don't understand the issue as well as he does.

Well, please, do explain where I'm mistaken here - is OCSP required not the most secure option? And it was rejected simply due to usability reasons on Chrome?

And the option to do so anyways for power users doesn't exist because Chrome is a browser for ease of use?

I'm not saying it's entirely ludicrous - for a good chunk of the user base CRLs are at least decent - but having an option for power users who desire more security should be available. And it's mandatory for any browser that wants to be used by power users.

Stop with the appeals to authority and make an actual argument if you disagree.

I don't understand the questions you're asking here, but, no, OCSP wasn't disabled simply due to usability reasons, but rather because it did not work.

It works just fine if you require an OCSP response and hardfail. Soft-failing is for usability and it's the cause of the problem.

Yes, must-staple is the optimal solution, but OCSP required is the best available today.

Look at some of the numbers here: https://www.grc.com/revocation/crlsets.htm

Soft failing isn't for "usability". OCSP simply doesn't work in situations where you would otherwise soft-fail, not because of any problem with the certificate, but because the protocol itself does not work.

How so? Replay might be a bit of a concern, but it's fairly time limited. The other stuff cited by Langley is just down to usability alone.

You are using the word "usability" to describe a situation in which extremely popular sites that are themselves doing everything right from a security perspective simply stop working --- because OCSP does not work. This is a silly conversation, and I'm opting out of it now.

> simply stop working

How would this happen? Are you suggesting that network failures are something that shouldn't impact even advanced users who've opted themselves in to the potential pitfalls in order to gain security?

I'm not suggesting hard-fail be the default, I'm suggesting CRLs be the default with hard-fail as an option for advanced users who know how to resolve problems when they do occur.

Interesting assertion. Back in 2008 when Chrome was released, that was exactly the same feeling people had about it. I remember some of us where sad to see the search bar and address bar combined, along with other stuff that Firefox, Explorer and other browsers had.

If I remember correctly, one of Chrome's objectives since the beginning has been to remove a lot of functionality and clutter (o yeah, the menu bar was another thing that Chrome did not have and drove some people crazy).

Why would they even change that?

I open Safari just for that... It wasn't like that a few versions back.

You open a different browser to save one button press?

It isn't a single button press. Right-click -> inspect -> Security -> View Certificate. Although I have to agree opening a new browser for checking a certificate is hilarious.

F12 > View Certificate

well at least if you have had selected Security in the dev tools last

On macOS, it's the "intuitive" command + option + i , which I can never remember (and then you still have to click on the stupid security tab, which is hidden if you don't have enough horizontal space on the dev tool frame)

It is much worse than the previously convenient click-on-lock-icon -> view certificate. Even on windows, F12 is usually a Fn key, so I have to select Fn+F12 which I never knew till the GP pointed it out to me.

Reply on news.ycombinator.com