Issue metadata
Sign in to add a comment
|
Should have additional warnings for https website using Lets Encrypt like certificate
Reported by
gaode...@gmail.com,
Mar 27 2017
|
||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Steps to reproduce the problem: 1. Open any https website that using ssl certificate signed by letsencrypt or some similar service provider. What is the expected behavior? What went wrong? The green 'Secure' label show in the address bar. However since the Lets Encrypt is automated certificate issuer. It won't check the domain name at all. The domain marked with 'Secure' could be: mypaypal.com or something similar for phishing purpose. As a web developer I understand the 'Secure' means the connection to the web site is secured. It has no mean the website itself is a secure one. But the fact 'Secure' label is marked just beside the domain name will give user the false sense that the web site is a trustable web site. Did this work before? N/A Chrome version: 56.0.2924.87 Channel: n/a OS Version: OS X 10.11.6 Flash Version: This idea is come from this slashdot post: https://it.slashdot.org/story/17/03/25/2222246/over-14k-lets-encrypt-ssl-certificates-issued-to-paypal-phishing-sites. My suggestion is if the ssl certificate is from automatic issuer like Lets Encrypt the browser should not show the 'Secure' label. And instead it should show additional warnings like 'the web site declared itself as xxx but not verified'. |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, Mar 27 2017Labels: -Restrict-View-SecurityTeam
Status: WontFix (was: Unconfirmed)