New issue
Advanced search Search tips

Issue 705435 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Mar 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug-Security



Sign in to add a comment

Should have additional warnings for https website using Lets Encrypt like certificate

Reported by gaode...@gmail.com, Mar 27 2017

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Steps to reproduce the problem:
1. Open any https website that using ssl certificate signed by letsencrypt or some similar service provider. 

What is the expected behavior?

What went wrong?
The green 'Secure' label show in the address bar.  However since the Lets Encrypt is automated certificate issuer. It won't check the domain name at all. The domain marked with 'Secure' could be: mypaypal.com or something similar for phishing purpose.

As a web developer I understand the 'Secure' means the connection to the web site is secured. It has no mean the website itself is a secure one. But the fact 'Secure' label is marked just beside the domain name will give user the false sense that the web site is a trustable web site. 

Did this work before? N/A 

Chrome version: 56.0.2924.87  Channel: n/a
OS Version: OS X 10.11.6
Flash Version: 

This idea is come from this slashdot post:
https://it.slashdot.org/story/17/03/25/2222246/over-14k-lets-encrypt-ssl-certificates-issued-to-paypal-phishing-sites.

My suggestion is if the ssl certificate is from automatic issuer like Lets Encrypt the browser should not show the 'Secure' label. And instead it should show additional warnings like 'the web site declared itself as xxx but not verified'.
 
Components: Internals>Network>Certificate
Labels: -Restrict-View-SecurityTeam
Status: WontFix (was: Unconfirmed)
LetsEncrypt is an automated certificate authority that provides Domain Validation. Their validation process is public and operates within the Baseline requirements of certificate authorities. Their certificates do not claim organizational validation, but they do correctly determine that the requested hostname is under control of the requester.

Sign in to add a comment