<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
@font-face
{font-family:Tahoma}
@font-face
{font-family:Consolas}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif"}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
p
{margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif"}
pre
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New"}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif"}
span.EmailStyle18
{font-family:"Calibri","sans-serif";
color:#1F497D}
span.apple-converted-space
{}
span.HTMLPreformattedChar
{font-family:Consolas}
span.EmailStyle22
{font-family:"Calibri","sans-serif";
color:#1F497D}
span.BalloonTextChar
{font-family:"Tahoma","sans-serif"}
.MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.WordSection1
{}
-->
</style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">My biggest problem with Google’s policy is that it is going to lead to quite a bit of advice to end users along the lines of “please ignore the red slash
through the lock; your connection is still secure”. This is because Google failed to coordinate the change with CAs, and websites have no choice but to issue such guidance since Google decided to ambush the internet community with this change.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">Red should mean there’s actually something actually wrong with the certificate, or that the certificate does not meet *<b>agreed upon</b>* requirements, not
just “Google doesn’t like it”. Feel free to use various forms of “less green” for things you feel are less trusted, but when you start putting up red UI elements, you’re just making an extremely confusing user experience even more confusing.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">I am extremely disappointed with Google’s unwillingness to engage in serious discussion about this issue. This, combined with Google’s rejection out of hand
of the code signing requirements before they are even finalized has caused me to have serious concerns about whether Google is capable of working productively with other companies to improve the security of the internet. *<b>Please</b>* prove me wrong.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D">-Tim</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<div>
<div style="border:none; border-top:solid #B5C4DF 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif""> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>kirk_hall@trendmicro.com<br>
<b>Sent:</b> Friday, August 29, 2014 1:09 AM<br>
<b>To:</b> Chris Palmer; Jeremy Rowley<br>
<b>Cc:</b> blink-dev; net-dev; rsleevi; CABFPub (public@cabforum.org)<br>
<b>Subject:</b> Re: [cabfpub] Intent to Deprecate: SHA-1 certificates</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"">Chris – a serious question. Is it true that
<span class="apple-converted-space"><span style="background:white"> </span></span><a href="http://google.com/" target="_blank"><span style="color:windowtext; border:none windowtext 1.0pt; padding:0in; background:white; text-decoration:none">google.com</span></a><span class="apple-converted-space"><span style="background:white"> </span></span><span style="background:white">is
still using <span style="color:#222222">SHA-1 in both end-entity and intermediate certificates today (as has been posted to this site)? If so, how can Google be so condemning of ordinary websites that are also using SHA-1 certs today, even though there has
been discussion of SHA-1’s potential weakness, as you say, for several years?</span></span></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#222222; background:white"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#222222; background:white">So many of the postings on this topics have shown a strong antipathy toward CAs – toward ALL CAs, without making any distinctions. Google
is painting everyone with the same brush. How can we turn this around, and create a more collaborative environment among browsers, browser users, CAs, website owners?</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#222222; background:white"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#222222; background:white">Google’s current policy will be creating a kind of chaos for many website owners in the next few weeks who have no idea why this is happening.
It will be affecting websites that have already started transition plans to SHA-256 certs before 2017. Isn’t there a better way?</span><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1F497D"> </span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"">
<a href="mailto:security-dev@chromium.org">security-dev@chromium.org</a> [<a href="mailto:security-dev@chromium.org">mailto:security-dev@chromium.org</a>]
<br>
<b>Sent:</b> Thursday, August 28, 2014 9:54 PM<br>
<b>To:</b> Jeremy Rowley<br>
<b>Cc:</b> blink-dev; security-dev; rsleevi; net-dev<br>
<b>Subject:</b> Re: Intent to Deprecate: SHA-1 certificates</span></p>
<p class="MsoNormal"> </p>
<p><br>
> Only if one ignores fairly clear statements from 6 months ago. Keep in mind that it's already 12 *years* after we've known from public literature that SHA-1 is significantly weaker than its designed guarantee.</p>
<p>Oops, 9 years now; 12 years in 2017. Sorry about that.</p>
<p class="MsoNormal">To unsubscribe from this group and stop receiving emails from it, send an email to
<a href="mailto:security-dev+unsubscribe@chromium.org">security-dev+unsubscribe@chromium.org</a>.</p>
<table class="MsoNormalTable" border="0" cellpadding="0">
<tbody>
<tr>
<td style="background:white; padding:.75pt .75pt .75pt .75pt">
<table class="MsoNormalTable" border="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt">
<pre> </pre>
<pre>TREND MICRO EMAIL NOTICE</pre>
<pre>The information contained in this email and any attachments is confidential </pre>
<pre>and may be subject to copyright or other intellectual property protection. </pre>
<pre>If you are not the intended recipient, you are not authorized to use or </pre>
<pre>disclose this information, and we request that you notify us by reply mail or</pre>
<pre>telephone and delete the original message from your mail system.</pre>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"> </p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information
contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.<br>
</font>
</body>
</html>