Podcast
Root Causes 390: Chrome Boosts Its Distrust Agility with a New Root Trust Deprecation


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
May 31, 2024
A root trust deprecation highlights new Chrome functionality that enables more agile and less disruptive distrust events. We explain the significant of this event.
Podcast Transcript
Lightly edited for flow and brevity.
This is different. This came from Chromium, not Mozilla. And there was no public discussion, because Chromium is not an open source project. Well, Chromium is, but the Chrome root store is not an open source project the way that Mozilla is. It's not a community run project. And so as a result, the hierarchy, the command and control there, made a decision and announced its decision to the world. So in that way, it's very different.
And so all of that was bad. Did this come out of the blue? Well, it came out of the blue in that there was no public discussion because that's not how Chromium does it. It didn't come out of the blue in terms of I wasn't surprised.
One is, we are going to try to scare everybody straight. We are going to pick the slowest antelope, and we're going to distrust and then all the other antelopes will get hurrying up. That is one possible interpretation.
Another possible interpretation was, when you looked at the field, like, it's hard to see how someone else would deserve distrust prior to EMC. So then you go, okay, well, if someone's gotta go, it's got to be EMC. But for all we know, Chromium or another browser, has more distrust they're planning on and they might not necessarily do them all on the same day. There might be good reasons to stretch it out, especially when I talk about some of the other things that are special about this particular event. And when we do that - because there's more here that's going on that’s a little unusual - when we do that, we can back up, and we can talk about why this might cause them to space these kinds of events out.
So and I'll remind you also that Google is not the only possible source. Mozilla, again, has been the major source of distrust over the years. Mozilla has published a Wiki page about the failure and offenses of one CA, which is not e-commerce monitoring and they have stated in a bug that they're preparing such a Wiki page for another CA, who is also not e-commerce monitoring. So it is very real possibility that at least two CAs are due to have the public dialogue on the Mozilla page about whether or not distrust is coming. That hasn't happened yet. And it may be that it won't. But in every time that there was one of those public dialogues, it started with one of these Mozilla Wiki pages. And so just having that page written about you, that's a bad thing. You don't want that. And that absolutely may progress. So it is possible right there that we're seeing daylight on to distrust events from Mozilla. And then we don't know what else. The root programs that don't do things on a public forum, like Chromium and Apple, they can do whatever they want, and we don't know what they're going to do.
So it is really possible, Jay, in response to your question, which is a good one, that this is not the whole event. That this is the start of the event. But we're just going to have to wait and see.
Upcoming changes in Chrome 124. and higher, goes as follows:
- TLS server authentication certificates, SSL certificates, validated to GLOBALTRUST 2020, whose earliest signed certificate timestamp, SCT, is dated after June 30, 2024 will no longer be trusted by default. TLS server authentication certificates validated GLOBALTRUST 2020 whose earliest STC is on or before June 30, 2024, will be unaffected by this change.

