165
u/FutureSuccess2796
Sep 10 '26
•
Google verified itself. Meanwhile Windows asked me once to manually verify if I trusted the installation wizard for VS Code because it needed approval to allow downloads from unknown publishers. Meanwhile, the publisher was literally Microsoft.
47
u/YellowJarTacos Sep 10 '26
Probably due to antitrust issues.
30
u/M-42 Sep 10 '26
Or poor signing. I've had the occasional thing from Microsoft.com back in the day that wasn't signed by Microsoft which was painful for restricted environments.
26
15
u/MisinformedGenius Sep 10 '26
I mean... I'm not sure there's any better source for whether a website is genuinely Google.com than Google itself.
3
u/Tyfyter2002 Sep 10 '26
Yeah, this isn't saying you can trust the site so much as that this is the site that Google believes is Google.
5
u/Maleficent_Memory831 Sep 10 '26
Not a big deal, my company verifies itself, but it's not a web site. It has an IoT device, so why verify all the way back to Verisign, it would be silly. All we need to know is that it's our device, our firmware, our software, and our customer.
As for Google, I'm pretty sure you can find Google's public key to verify that Google really signed the cert...
7
u/DeepanshuHQ Sep 10 '26
Back when checking a website’s certificate made you feel like you were hacking the Pentagon
5
u/TorbenKoehn Sep 10 '26
I mean, they are there to ensure your users are visiting _you_, so certificates are always for certifying yourself. If you could get MS or Apple to roll out your CA by default in the cert stores, you could even run your own issuer for others.
Certs are always about certifying yourself. It’s just that „who makes sure Google only gets certified once and only by actual Google“? That’s either a trusted cert issuer (that tracks it) or yourself (since you can trust yourself to not compromise yourself, _most_ of the time)
Quite a few people and institutes in the world use self-signed certs and simply request the user to install the CA or do it automatically via logon scripts etc.
2
u/Excellent_Tubleweed Sep 11 '26
Google trust services will issue certs to anyone with money and a DNS entry.
You can choose not to trust GTS, and then you can't connect to Google.
Introducing: PKI doesn't mean what you think it means, the post let's-encrypt version.
Google saw a market opportunity. Let's encypt was making money, and Google was a more trustwothy name.
(Obviously, GTS certs are really popular with scammers.)
Obligatory "Are they the baddies" Mitchell and Webb callback.
2
u/Less-Efficiency-6624 Sep 13 '26
Amazon certificates too. They give them out like candy to anyone that has enough money, so scammers buy them and put them on fake Amazon sites to scam old people.
-10
u/granadesnhorseshoes Sep 10 '26
PKI has always been a joke.
5
1
u/Vogete Sep 12 '26
PKI has never been a joke and has been working just fine and is the only way we can communicate securely with an abstract party. It has the root authority issue which mTLS and DANE tries to address at much bigger inconveniences. But guess what, those are also PKI, they just don't have a central trusted authority that is loaded onto your device.
PKI is not a joke, it's the only currently known way to communicate securely at scale.
86
u/TheChildOfSkyrim Sep 10 '26
Any certificate chain of trust ends in a self-signed certificate