How Symantec upsells Internet Explorer 5 SSL support in 2015 | Hacker News Reader

How Symantec upsells Internet Explorer 5 SSL support in 2015

certsimple.com

59 pointsnailer44 comments

Worth noting that CertSimple is a competitor of Symantec, and can't offer SGC certificates, so they are basically whinging that their competitor is marketing their certificates on a feature people don't need.

That's basically par for the course when selling to businesses, especially where non-technical people are in a position of deciding whether to buy, and which vendor to chose from.

It'd also be nice if HackerNews wasn't quite so populated with thinly veiled ads for companies disguised as blog posts.

We sell SSL certificates and we're quite proud of it.

> can't offer SGC certificates

We could sell SGC products today if we wanted to - we have the API keys, a partner account with another certificate provider (not Digicert), and a node module written for the relevant REST API. We don't want to.

> are basically whinging that their competitor is marketing their certificates on a feature people don't need.

Marketing certificates on a feature people don't need - and making it seem as if they need it - is wrong.

> That's basically par for the course when selling to businesses, especially where non-technical people are in a position of deciding whether to buy, and which vendor to chose from.

Being common does not make it right.

If you think it does: what's the name of your startup? Your bio is empty, and I think most of HN would be interested in knowing the name of a business that thinks this is OK.

Furthermore it's not 'par for the course': many other CAs don't sell IE5 support as hard as Symantec does. Here's DigiCert writing against SGC (we use DigiCert as our CA) https://www.digicert.com/sgc-ssl-certificates.htm, here's their competitor GoDaddy writing against SGC: http://agrihortico.com/freedownloads/SGC.pdf

what's the name of your startup? Your bio is empty, and I think most of HN would be interested in knowing the name of a business that thinks this is OK.

Ugh, seriously? I was vaguely fine with the blog post before (though it is a bit advertisement-y for HN in context), but this is reprehensible (at least in the context of judging companies by the stances their employees take...).

It's also reprehensible to say that it's OK for companies to cheat their cusomters. I don't think the CertSimple guy was actually trying to boycott that guy's company, he was trying to make a point.

I read it as a mixed call to boycott (and shaming) together with an appeal to CertSimple's expertise; "I don't see you actually having any startups, and thus your opinion is meaningless. If you do have a startup you certainly are a bad startup."

It's a simple statement that companies shouldn't cheat their customers, nor should we support companies (including HN startups) that think it is OK to cheat their customers.

I guess the author of the post, seeing someone defending what Symantec's doing, seems to have mistakenly assumed they are a Symantec employee. Perhaps they jumped to conclusions to quickly.

Just so you know, from a third party perspective, this reply looks ridiculous.

Since when does everyone on HN automatically work for a startup?

> what's the name of your startup?

Why do you assume that every HN user is involved with some startup?

Is DigiCert able to provide SGC but they choose not to, or are they unable to do so?

Browsers only trusted a limited number of roots for SGC. I wonder if any SGC certs actually were issued off "GTE CyberTrust Root" that expired in 2006.

Do you know how to identify if a Root can issue SGC certs?

I am seeing an OID (2.16.840.1.113730.4.1) in the EKU field for both End-Entity and Intermediate Certs from Thawte, but nothing on the Root.

Was the ability to issue an SGC cert more of a policy thing than an actual flag in the cert?

I BELIEVE that DigiCert used to issue certs with SGC if you specially requested it, but I cant find any sources on that at the moment.

It was a list built into the browser. For IE/SChannel they hardcoded two roots (into RSABASE.DLL/RSAENH.DLL I think), the VeriSign Class 3 root and "Root SGC Authority". When they added new roots into IE 5.01/NT4 SP6/Win2000, they made some of them SGC capable by shipping cross certificates to this "Root SGC Authority" (you can still see them if you have a WinXP system). The reason Thawte SGC SuperCerts uses the VeriSign root now was that this particular cross certificate expired in 2004.

I'm not sure re: Digicert, we (CertSimple) have an alternate certificate source that can provide SGC certificates, and choose not to.

>If you think it does: what's the name of your startup? Your bio is empty, and I think most of HN would be interested in knowing the name of a business that thinks this is OK.

So much for the recent initiative of a calmer more respectful discourse here at HN. Now its "criticize my company? Fuck you, who do you work for so I can criticize you!"

Companies calling out their competitors when they cheat customers and rip them off is a feature, not a bug.

Indeed; "thinly-veiled ads" by an opponent in a zero-sum game is the impoetus behind half the useful data-gathering and analysis in the world. See: misdeeds by one political party investigated by an opposing party to create hit pieces; evidence investigated by the prosecution and defense on a criminal case to prove one-another wrong; etc.

There are people in the business of exposing corporate fraud, and the way they make money is by shorting the stock before exposing the fraud.

You are right, CertSimple is a competitor (reselling Digicert), but nothing in their blog post is wrong. They may be getting benefical advertising from this post, but they are doing so by providing a public service calling out the baseless fear mongering from Symantec and other CAs.

As nailer replied, it may be common, but it is not right. Those tactics should be called out and shamed whenever possible.

I hate how certs have become this SEO-like snake oil, promoted in equally devious ways. This is pretty much free advertising for certsimple and an attack on some outdated Symantec webpage.

Today its x cipher with y bits. Tomorrow its something else. Picking on old marketing and sales pages isn't the big scoop HN thinks it is.

>It'd also be nice if HackerNews wasn't quite so populated with thinly veiled ads for companies disguised as blog posts.

Have we had our weekly Cloudflare lovefest yet?

It would be even nicer if useful content wasn't immediately slagged on in the comment section by people accusing them of impropriety. So much for no gratuitous negativity...

I think this is less malicious and more lazy... Isn't this just a super-outdated marketing webpage for a certain global market that was never taken down or redirected to the updated version?

I'm able to load the site, but when I click on any of the menu options I'm given a redesigned site with an updated version of the SSL options. [1] I thought it might be a regional thing since this was in Asia-Pacific so I switched the "aa" to "uk" and that tab doesn't even exist anymore. [2]

Although I was only able to get to a few pages before my browser session was blacklisted as well. Sigh. Pretty annoying. [3] Luckily it is cookie based and not IP based. (I don't think it needs to be said but I have no relation to Symantec or Certsimple.)

[1] http://www.symantec.com/en/aa/ssl-certificates/?inid=aa_ghp_...

[2] http://www.symantec.com/en/uk/page.jsp?id=how-ssl-works&tabI...

[3] I'm now greeted with: Access Denied You don't have permission to access "http://www.symantec.com/" on this server.

Symantec removed SGC from their products about 1-2 months ago. So you are right, these are outdated - but they are not relics.

Symantec was peddling SGC pretty strongly before then, including "SGC" in the name of their products.

Yeah it's weird: some locales for 'Introduction to SSL' have the old copy, some have a newer version with SGC removed.

(edit: removed ref to Secure Site Pro page - as yuhong points out below, it looks like the Pro product has been redefined to be non-SGC now)

But notice there is no mention of SGC anymore, and instead they mention ECDSA now. And you can only actually get SGC by getting a SHA1 certificate.

VeriSign, GeoTrust, Thawte and RapidSSL are all Symnantec? What a racket. Clever work, Certsimple.

Yes: http://www.netcraft.com/wp-content/uploads/2010/05/certauth_...

And thanks!

For those doing their own research. This is some data I pulled together last year.

https://docs.google.com/spreadsheets/d/1jzZqGzvtHe4egYNnp1L4...

Nice! The main point of CertSimple is 80 second EV application process (including generating the CSR) and EV issuance in an average of five hours - this could be a worthwhile addition to the the 'Notes' column.

Mind if I add certly.io?

Send me an e-mail (scott.markwell@gmail.com) with a email to give edit access too.

Author here.

Asides from the 'Introduction to SSL' page mentioned in the article, there's a few other places Symantec mention SGC/IE5 support, including http://www.symantec.com/ssl-certificates/ - the 1st and 3rd products include SGC/IE5 support and are more expensive than the equivalent (non 'Pro') products without SGC/IE5 support.

Hopefully this results in Symantec (and the resellers who use their marketing materials) making it clear that SGC technology only applies to very old browsers, rather than Symantec sending a nastygram to my office.

They at least have finally began to switch to marketing ECDSA certificates as the main difference now, especially as SHA1 certs becomes obsolete. Last time I checked Symantec's site I actually have to specifically look for SGC to find this stuff now.

You are right Yuhong. Symantec's "Pro" products used to advertise SGC, now they are using ECDSA instead.

Thawte have at least began hiding the SGC option. Also note that Netscape Step-Up (not to be confused with MS SGC) depends on insecure renegotiation, which is disabled in many servers now (I have a few pcaps I did with Netscape 4 showing this, and I really should factor the 512-bit RSA keys in some of them at some point). Another trivia is when VeriSign began selling EV certs in 2007 they only sold it with SGC, even though it was becoming obsolete even back then.

SSL will never be good, Encryption which only a few can afford is mostly not good. Also most SSL Providers have their seat in USA, which also means that we NEVER knew if the encryption could be decrypted. Encryption which will be held by any "bigger" company will also have this flaw, even from germany or any other european company (any company in any country will have that flaw). The only encryption that would work, would be self made encryption, which is barely supported by browsers. http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Nam...

Regarding your first point, the people at https://letsencrypt.org/ are working to address that.

letsencrypt.org seems to be the new GNU Hurd or Duke Nukem Forever.

An SSL provider doesn't have your encryption keys. They could MITM your site, but at a risk that whoever gets MITMed has cryptographic proof that they issued a cert illegally, which if publicised would get them dropped. See google/china for the most recent incident where this happened.

Also, if you simply implement public key pinning, you can no longer be MITMed.

These points have been debunked dozens of times. SSL is EASILY affordable. Not only are there free options, but many sites provide widely-trusted certs for around $7/yr.

There is little legitimacy behind the claims that the US has backdoored encryption via the actual algorithm. Cryptography professionals have pointed to a few specific ECC curves that may have issues but there is nothing conslusive.

Im assuming by "self made encryption" you mean self-signed certs. These will never work - first off they do nothing to compensate for algorithmic flaws which you purport exist. They also provide no identity assurance, which makes it impossible to determine the difference between a legitimate/illegitimate key change.

> Not only are there free options

Last I checked, there's no plural in that; the only free certs available (as far as I know) are the ones from StartSSL, and these aren't free to businesses (or individuals who don't have a residential mailing address and had to rely on a P.O. Box, as was my case), and the customer support makes Comcast look heavenly in comparison.

And no, Let's Encrypt doesn't count yet.

> but many sites provide widely-trusted certs for around $7/yr.

Which ones? I'd be interested in making more of my things SSL'd if I knew I could get certs for that cheap. Are those for specific domains or are they wildcards? If the former, does a www cert cover the apex domain (or vice versa)?

>Providers have their seat in USA

We have evidence of Putin using Kaspersky to find the identity of political dissidents and other awful things. Meanwhile, you have conspiracy theories that get you upvotes on reddit and other kiddie sites, but zero proof SSL has been infiltrated. Personally, if these companies weren't US or EU I would be worried. I don't think Russia or China are the freedom and human rights utopias you think they are. 57 and 91 on the Human Rights Development Index impresses no one.

http://en.wikipedia.org/wiki/List_of_countries_by_Human_Deve...

I think some of the Snowden docs claimed SSL was cracked.

Edit: look up BULLRUN.

Reply on news.ycombinator.com