科技回声

If you use a self-signed certificate to secure a website, Google Chrome's reaction is somewhat dramatic and I would say inaccurate and misleading. Below is a screenshot (sorry, you'll have to accept the certificate to view it!):https://puntoshare.com/resource/BvihzPScThe Google Chrome url bar with the "https" and "padlock" icons crossed out with a bold red line would suggest to the user that the page is not encrypted, does not use HTTPS and is 'not safe'.Of course, this is not true and the Chrome 'site information' text clearly states that the site is secured with 256-bit encryption (and displays a reassuring green padlock icon). However, I am sure very few users actually view the 'site information' text.I agree that the certificate does not verify the identity of the site, but this is a separate issue, right? I just want to ensure the user that information passed to/from the server is encrypted.We visit unsecured websites all the time and we have no idea how safe they are or who owns them and browsers give us absolutely no warnings, so I am a bit disappointed that when I do attempt to increase security for the end-user the browser works against me, implying the site is unsafe.Can't Google bypass the CA's and implement their own site authentication mechanism (for free)?

5 条评论

dchest将近 13 年前

Did you read the warning? It pretty much answers your question:"This may mean that the server has generated its own security credentials, which Google Chrome cannot rely on for identity information, or an attacker may be trying to intercept your communications."I just want to ensure the user that information passed to/from the server is encrypted.Self-signed certificate doesn't guarantee the encrypted communication to/from your server. An attacker can intercept your handshake request and provide their own self-signed certificate.You can create your own CA, sign a server certificate with it, and then ask users to install your CA certificate into their browsers.Or you can get a free certificate from StartSSL.Alternatively, you can contribute to some replacement for TLS.

评论 #4155888 未加载

评论 #4155853 未加载

Piskvorrr将近 13 年前

What makes Chrome special here? AFAIK, every browser (FF, IE, Opera, you name it) treats HTTPS with problems as "extremely scary, alert the President" (which is, IMNSHO, absolutely correct behavior - "this site says it's HTTPS://whatever, but I'm unable to verify this, so let's crash and burn - it might just as well be <a href="https://evilsite.evil" rel="nofollow">https://evilsite.evil</a>, for all I know"), whereas unsecured, plain HTTP is seen as "meh, whatever."Moreover, "why can't Google fix the Internet?" is, essentially, saying "do away with the other CAs, and make Google the ultimate CA" - doesn't fix the problem, plus makes it worse.(FWIW, there are cheap SSL certs out there which are signed by known CAs and thus don't trigger the security error.)

评论 #4155803 未加载

mooism2将近 13 年前

Without verifying the identity of the site somehow, you are vulnerable to a mitm attack. So no, it's not a separate issue.What is your proposed site authentication mechanism that Chrome should use (and does it scale to Firefox, Safari, etc)?

评论 #4155817 未加载

Sambdala将近 13 年前

The red warning page you have to click through also seems irresponsible to use in cases like this.It's the same page you get when there's malware on a site.

评论 #4155840 未加载

tcarnell将近 13 年前

I think I would be more relaxed if browsers used an additional icon to indicate if a site identity is verified or not.And just because somebody has paid for a site certificate and gets a nice green padlock icon on the URL bar does not mean they wont misuse peoples personal information, does it?

5 条评论

dchest将近 13 年前

评论 #4155888 未加载

评论 #4155853 未加载

Piskvorrr将近 13 年前

评论 #4155803 未加载

mooism2将近 13 年前

评论 #4155817 未加载

Sambdala将近 13 年前

The red warning page you have to click through also seems irresponsible to use in cases like this.It's the same page you get when there's malware on a site.

评论 #4155840 未加载

tcarnell将近 13 年前

Chrome and misleading security information

5 条评论

Chrome and misleading security information

5 条评论