This Connection is Untrusted

**chitown** · 23-10-2011, 09:51 AM

Why am I getting this message all of the sudden and how do I kil it? I can't get to my internet banking to pay US bills, make transfers etc.

This Connection is Untrusted

You have asked Firefox to connect
securely to payments.chase.com, but we can't confirm that your connection is secure.

Normally, when you try to connect securely,
sites will present trusted identification to prove that you are
going to the right place. However, this site's identity can't be verified.

What Should I Do?

If you usually connect to this site without problems, this error could mean that someone is trying to impersonate the site, and you shouldn't continue.

Technical Details

CHITOWN'S BANK uses an invalid security certificate.

The certificate is not trusted because the issuer certificate has expired.
The certificate will not be valid until 12/30/2010 7:00 AM.
I Understand the Risks

**chitown** · 23-10-2011, 09:55 AM

This is happening with yahoo mail and aol mail and a few other sites.

**Thetyim** · 23-10-2011, 09:58 AM

Is your computer date/time correct ?

**chitown** · 23-10-2011, 10:10 AM

Originally Posted by Thetyim

Is your computer date/time correct ?

Thanks, saved by Thetyim again

I was tired of seeing the Thai year on there so I fiddled around with the time and date settings. I changed the location to US and somehow had the date as October 23, 1980.

I owe you a meal - somtum or a pizza or what?

**SEA Traveler** · 23-10-2011, 10:43 AM

good job Thetyim... and to your chitown for allowing others to learn from your, ummmm! your being inconvenienced...

**aging one** · 23-10-2011, 10:45 AM

its nice when this place works well, puts all the bitching about the good old days back in the shadows. Well done.

**Thetyim** · 23-10-2011, 11:06 AM

Go into Time & Date settings
Click on Internet Time
Set to 'auto'

It will then update your computer clock automatically

**chitown** · 23-10-2011, 11:07 AM

I never would have thought something so simple would have caused me so much stress. I was not sure how I was going to pay my bills back home and transfer cash here.

**Sailing into trouble** · 23-10-2011, 11:09 AM

Think Greens for asker and teller. Not often a thread that is pleasant and constructive and has a happy ending.

**harrybarracuda** · 23-10-2011, 11:44 AM

The certificate will not be valid until 12/30/2010 7:00 AM.

Bit of a fucking giveaway.

Why don't people actually read the error messages?!

**Sailing into trouble** · 27-10-2011, 10:50 AM

Originally Posted by harrybarracuda

Why don't people actually read the error messages?!

SOmetimes you are too Easy Harry!

All together now 1 2 3 .........BECAUSE WE USE MACS and don't get error messages

**Butterfly** · 27-10-2011, 10:52 AM

Originally Posted by Sailing into trouble

Originally Posted by harrybarracuda

Why don't people actually read the error messages?!

SOmetimes you are too Easy Harry!

All together now 1 2 3 .........BECAUSE WE USE MACS and don't get error messages

obviously you never looked at your message console on a MacOSX, tard

**Sailing into trouble** · 27-10-2011, 01:14 PM

Tard! That must be a PC error message! Don't get upset BF I hope many people keep using PCs for years to come. Everyone needs a hobby! Fixing broke operating systems of doubtful windows origins seems to keep many people happy and fulfilled.

I kicked the habit a few years ago, don't give up the dream, you to can be free from the power of the dark side

**harrybarracuda** · 27-10-2011, 01:48 PM

Originally Posted by Sailing into trouble

Originally Posted by harrybarracuda

Why don't people actually read the error messages?!

SOmetimes you are too Easy Harry!

All together now 1 2 3 .........BECAUSE WE USE MACS and don't get error messages

Oh really? So your 'tard Mac will happily accept an invalid certificate without warning you?

What a piece of shit that is.

**Sailing into trouble** · 28-10-2011, 07:21 AM

Harry you have to understand that our mac's love us and make sure that we live happy and fulfilled lives. They would never let any nasty thingy certified nutty things hurt us

**Butterfly** · 28-10-2011, 07:33 AM

^ sounds like brainwashing, Jesus is dead, wake up, it was all a dream

**baldrick** · 29-10-2011, 01:47 PM

this is a little worrying - all cert auth's are not created equal - it might be a nice plugin to have on your browser , a rating on the CA that has issued the cert for the HTTPS sites you visit

https://threatpost.com/en_us/blogs/e...ed-june-102711

EFF Data Shows Four CAs Compromised Since June
The EFF, through the use of its SSL Observatory, has taken a look at the data from certificate revocation lists for SSL certificates in recent months, and found that there were four separate CAs compromised in the last four months. The data that the EFF looked at was a summary of the reasons that specific certificates were revoked by CAs, as reported by the CAs themselves in CRLs. When a certificate is revoked, the CA specifies a reason for the action, and the EFF looked through the data collected in its SSL Observatory database and found that a scan of CRLs in June showed that 10 individual CAs reported that they were revoking 55 total certificates because of a CA compromise. Another scan in mid-October showed that 14 separate CAs had revoked 248 certificates because of a compromise.
"Those "CA Compromise" CRL entries as of June were published by 10 distinct CAs. So, from this data, we can observe that at least 4 CAs have experienced or discovered compromise incidents in the past four months. Again, each of these incidents could have broken the security of any HTTPS website," Peter Eckersley of the EFF wrote in an analysis of the data.

**harrybarracuda** · 29-10-2011, 02:08 PM

Originally Posted by baldrick

this is a little worrying - all cert auth's are not created equal - it might be a nice plugin to have on your browser , a rating on the CA that has issued the cert for the HTTPS sites you visit

https://threatpost.com/en_us/blogs/e...ed-june-102711

EFF Data Shows Four CAs Compromised Since June
The EFF, through the use of its SSL Observatory, has taken a look at the data from certificate revocation lists for SSL certificates in recent months, and found that there were four separate CAs compromised in the last four months. The data that the EFF looked at was a summary of the reasons that specific certificates were revoked by CAs, as reported by the CAs themselves in CRLs. When a certificate is revoked, the CA specifies a reason for the action, and the EFF looked through the data collected in its SSL Observatory database and found that a scan of CRLs in June showed that 10 individual CAs reported that they were revoking 55 total certificates because of a CA compromise. Another scan in mid-October showed that 14 separate CAs had revoked 248 certificates because of a compromise.
"Those "CA Compromise" CRL entries as of June were published by 10 distinct CAs. So, from this data, we can observe that at least 4 CAs have experienced or discovered compromise incidents in the past four months. Again, each of these incidents could have broken the security of any HTTPS website," Peter Eckersley of the EFF wrote in an analysis of the data.

Only an issue if you're visiting a fake website with a seemingly valid certificate, surely?

**baldrick** · 29-10-2011, 07:48 PM

Originally Posted by harrybarracuda

Only an issue if you're visiting a fake website with a seemingly valid certificate, surely?

DNS poisoning to direct you to your what you think is your banking portal

**harrybarracuda** · 29-10-2011, 10:11 PM

Originally Posted by baldrick

Originally Posted by harrybarracuda

Only an issue if you're visiting a fake website with a seemingly valid certificate, surely?

DNS poisoning to direct you to your what you think is your banking portal

There's not really much of a threat, it would have to be quite global and it would be public knowledge by now.

More idiots get conned clicking on links warning them about their banking password and typing it into a fake site that doesn't even offer a certificate.

And then there's still work to be done transferring money out of the account and getting it safely collected.

Normally this turns into the "We need a finance manager, all you have to do is transfer 95% of the money we send you (to Nigeria or Russia) and you keep the rest", via targeted emails to other bank customers.

There's been a fair few money laundering cases launched in my part of the world which usually result with the stupid sods who did it paying the bank back in settlement and being out of pocket. Why the banks don't just offer two-factor authentication I have no idea.

I think the reason this certificate leak hasn't had more press is that in itself, it doesn't present much of a risk.

Thread: This Connection is Untrusted

Thread Tools

Display

This Connection is Untrusted

Thread Information

Users Browsing this Thread

Posting Permissions