‘Secure’ in Chrome Browser Does Not Mean ‘Safe’

[DaftDog]

Read this on the Wordfence blog:

1. We show that SSL certificates are being issued by more than one certificate authority (CA) to phishing sites pretending to be Google, Microsoft, Apple and other well-known companies.
2. A valid certificate causes Chrome to show a website as “Secure”.
3. When a certificate is revoked once a CA realizes they should not have issued it, we show that Chrome still shows the site as “Secure”. The “revoked” status is only visible in Chrome developer tools.
4. Malicious sites that have been issued valid SSL certificates take some time to appear on Chrome’s malicious site list. We show that the safe browsing list can not be relied on as a backup mechanism to protect users from malicious sites with valid SSL certificates.

Read more.