I have been using the same Google-Starbucks location for three days now, just taking care of personal business while waiting for my car to get fixed at Starbucks. I was able to access goldmoney.com and transfer money to my bank account, but now it seems like my wifi connection is being interrupted specifically for that website's certificate authority. Also curious if the NSA or some agency involved at other local network nodes are interested in me accessing that website. What's possible and what is likely happening?
-
The problem there appears to be "WEAK_SIGNATURE_ALGORITHM" rather than an invalid certificate - it could be that the site you're trying to access is behind the times with security and a browser update has decided that it's no longer safe to access it on those terms. But it's marked as "WEAK" for a reason so even if it appears valid, it probably should not be trusted.– Mark K CowanJul 12, 2017 at 16:12
-
In that post, I attempted the access using Chrome. Due to your comment, I then attempted to access it via Safari and successfully connected.– Timothy SwanJul 12, 2017 at 16:20
-
Great. I posted as a comment because it was speculative, I didn't research at all. But if no better (i.e. researched) answers appear, please could you mark mine as accepted.– Mark K CowanJul 12, 2017 at 16:25
Add a comment
|
2 Answers
Google (and by extension Chrome) is fairly aggressive at deprecating algorithms commonly used for TLS, and will complain even when there are no specific security vulnerabilities, just the use of an algorithm they want to see pushed into obsolescence.
In this case, they're complaining about the signature algorithm. That most likely means that the certificate was signed with SHA-1, and has an expiration date too far in the future for Google's taste. That doesn't mean that there are any issues with the site or the certificate today...It's simply a stick that Google has chosen to use (for better or worse) in order to push CAs and end-user organizations to update to better algorithms.
So, while in a macro sense this behavior means that we're getting a stronger, more secure web, looking at just this specific instance it meant that you got what at first glance appears to be a serious warning about an issue that doesn't actually present any security issue to you at all.
The problem there appears to be "WEAK_SIGNATURE_ALGORITHM" rather than an invalid certificate - it could be that the site you're trying to access is behind the times with security and a browser update has decided that it's no longer safe to access it on those terms. But it's marked as "WEAK" for a reason so even if it appears valid, it probably should not be trusted.
