Google will stamp down on SHA-1 security certificates in 2016

By Brad Jones December 21, 2015

android lollipop problems at google hq — Image used with permission by copyright holder

Over the course of 2015, Google has been actively tightening up its standards in relation to security certificates — the cryptographic codes used to establish which connections can and cannot be trusted. Heading into next year, the company has announced further restrictions on the certificates supported by its Chrome browser.

Any website using a SHA-1-signed certificate issued after January 1, 2016, will be blocked as of an unspecified date in the early part of next year, according to a report from Tom’s Hardware. While the algorithm has been set for depreciation for some time, there’s been more impetus to do so in recent months.

A team comprising of Marc Stevens, Pierre Karpman, and Thomas Peyrin published research earlier this year that suggests a criminal entity could carry out an SHA-1 collision attack for around $100,000. With that kind of accessibility, Google and other organizations are thought to have sped up plans to discontinue support.

The Baseline Requirements for SSL have been updated to stipulate an end to any distribution of SHA-1 certificates in 2016, so it seems clear that the writing is on the wall for the algorithm. However, there seems to be little downside to Google being proactive in cleaning up any perceived threats to the quality of Internet access.

In recent months, Google has targeted security software firm Symantec, after doubt was cast over the way that the company was issuing its certificates. Earlier this month, Symantec made a request to Google that one of its legacy certificate be untrusted or removed.

At present, Firefox and Microsoft Edge are also expected to begin blocking SHA-1 certificates before the end of 2017. However, given that Google has chosen to accelerate the process, it wouldn’t be all that surprising to see others follow suit.

Editors' Recommendations

Topics

Former Digital Trends Contributor

Brad is an English-born writer currently splitting his time between Edinburgh and Pennsylvania. You can find him on Twitter…

Computing

The M1 has a major security loophole that Apple can’t patch

Apple M1 processor on a mainboard.

Researchers at MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) have discovered a new security vulnerability that targets Apple's popular M1 processor. The attack, dubbed PACMAN, is capable of bypassing the last line of defense against software bugs on the M1 and potentially other ARM-based processors.

PACMAN attacks pointer authentication, which is the final stop for most software vulnerabilities. Pointer authentication confirms that a program hasn't been changed in any malicious way, serving as a "safety net ... in the worst case scenario," as MIT PhD student Joseph Ravichandran put it. MIT's researchers developed PACMAN as a way to guess the pointer authentication signature, bypassing this critical security mechanism. Researchers say PACMAN exploits a hardware mechanism, so a software patch won't be able to fix it.

Computing

Microsoft Edge vs. Google Chrome: Performance, design, security, and more

microsoft edge chromium to roll out automatically soon chrome

Google Chrome remains the king of the web browsers, with around 60% share of the browser market as of December 2021. Microsoft's Edge browser, which uses the Chromium open-source engine, is in a lower spot around 12%, which is impressive with the browser having only been introduced in the last couple of years. Microsoft pushed the new Edge to all Windows 10 desktops, replacing the old Windows 10 version and giving Edge a built-in -- well -- edge. Edge is also the default browser for Windows 11.

Which browser should you use? The two share a lot of similarities, but some key differences make one the clear winner.
Design

Mobile

Pixel 3a confirmed to get Android 12L even as Google winds down Pixel 3 support

Google Pixel 3a XL hands on.

With the announcement of Android 12L, Google shared a list of Pixel phones expected to receive the beta when it began the testing period in December. While the Pixel 3 was understandably absent, Google also didn't include the newer Pixel 3a -- which was taken as an indication that it was likely not going to get the newer Android version when it rolls out. Fortunately, that's not the case, as Google confirmed to Digital Trends over email that it was an oversight and documentation would be updated shortly.

According to Google, the Android 12L beta will be going out to the following Pixel phones: Pixel 6 Pro, Pixel 6, Pixel 5a with 5G, Pixel 5, Pixel 4a (5G), Pixel 4a, and Pixel 4. It will not be coming to the Pixel 3, which received its last guaranteed update with Android 12. The Pixel 3's exclusion is a little weird, though. Launched in May of 2019, Google promises updates for up to three years post-launch. As indicated by the company's Pixel software support list, this means the Pixel 3a should expect major updates through May of 2022.