Target Redcard Login Unsafe???

[BluePoodle]

---

@CreditCuriousity wrote:

weird google chrome is taking out the HTTPS as you can see it is crossed out for whatever reason..  Maybe Target let their certificate accidently expire and this is causing the chrome issue and chrome is catching it?  I will let other people chime in here..  Difference between HTTP and HTTPS in the simplest terms is the S stands for Secure and uses encryption, although there is more to it than that.  I work in tech, just in my line of work I really don't have to deal with browsers and certificates..  I am sure someone else will chime in here.  

---

Thank you! That is what I needed to know. I do remember reading that now that you mention it. So log in should ALWAYS be HTTPS?  I just checked login on my others and they are fine.  Not sure WHAT Target's deal is though.

[BluePoodle]

---

@CreditCuriousity wrote:

---

@BluePoodle wrote:

---

@elim wrote:

---

@CreditCuriousity wrote:

Ya I wouldnt be loging in without https....  

---

   ahhh is that what the strikethrough is in the addy? i don't know macs at all. does mac show the Veri-sign check like MS?

---

Yeah, that is what is striking through in red in addy bar. Considering I have no idea what a Veri-sign check is, I would say no, Macs don't have that. They generally do a couple of warnings like the photo I just posted stating that the site is not secure and asking if you want to proceed.

---

Verisign is a certificate...  Either they let it expire or something else is up... Their is no difference with a Mac or PC w/regards to if they let their certificate expire or whether it is another issue..  In other words if Verisign certificate was good it works on both mac's and pc just the same

---

When I collapse the warning, it states: NET::ERR_CERT_AUTHORITY_INVALID

The address shows up fine under Firefox, so I logged in there. Not sure if it is a Chrome update I need or something that is an issue for Chrome in general. ???

[CreditCuriosity]

---

@BluePoodle wrote:

---

@CreditCuriousity wrote:

---

@BluePoodle wrote:

---

@elim wrote:

---

@CreditCuriousity wrote:

Ya I wouldnt be loging in without https....  

---

   ahhh is that what the strikethrough is in the addy? i don't know macs at all. does mac show the Veri-sign check like MS?

---

Yeah, that is what is striking through in red in addy bar. Considering I have no idea what a Veri-sign check is, I would say no, Macs don't have that. They generally do a couple of warnings like the photo I just posted stating that the site is not secure and asking if you want to proceed.

---

Verisign is a certificate...  Either they let it expire or something else is up... Their is no difference with a Mac or PC w/regards to if they let their certificate expire or whether it is another issue..  In other words if Verisign certificate was good it works on both mac's and pc just the same

---

When I collapse the warning, it states: NET::ERR_CERT_AUTHORITY_INVALID

The address shows up fine under Firefox, so I logged in there. Not sure if it is a Chrome update I need or something that is an issue for Chrome in general. ???

---

Sounds like an issue on targets aisw/site, not chrome being the certificate is held on their end...  As a rule always update to the most recent version of Chrome... 

[core]

I would start by updating the certificate authorities list in Chrome as it may have gotten buggered up.  The cert itself is likely perfectly fine, but if Chrome doesn't trust the authority then it will make no difference. 

[Kellan]

Actually I went to the Target site in chrome so I could tell you what the issue really is. Google made a decision to not accept one type of older security that is supposed to be retired in 2017. But google decided to not trust these certificats anymore starting in 2015. The reason Target is not switchig certificates yet is because many people still use WinXP and the newer certs dont work with WinXP. Google is really just being a little over zealous. 

Target site has not been hacked and is safe. 

[longtimelurker]

---

@Kellan wrote:

Actually I went to the Target site in chrome so I could tell you what the issue really is. Google made a decision to not accept one type of older security that is supposed to be retired in 2017. But google decided to not trust these certificats anymore starting in 2015. The reason Target is not switchig certificates yet is because many people still use WinXP and the newer certs dont work with WinXP. Google is really just being a little over zealous. 

Target site has not been hacked and is safe. 

---

Works fine for me in Chrome on Windows (Chrome  40.0.2214.91 m)

[nyancat]

---

@CreditCuriousity wrote:

Ya I wouldnt be loging in without https....  

---

It is HTTPS, look at the address bar. See the "HTTPS"? Yeah, it's HTTPS.

The red strikethrough though is usually not a good sign. It means that the HTTPS connection isn't trusted for some reason. I went to the same site in Chrome on a Mac and get the same error, and I absolutely trust my internet connection and DNS right now (it's a VPN to a provider I trust a great deal).

So, I decided to dig a bit deeper. This appears to be caused by Chrome using the built in certificate trust of OS X, and the trusted root certificates being out of date or otherwise not trusting this cert. If you look at the details at the bottom, the error is that the root CA isn't trusted. The same error occurs in Safari. Now, go to the top, click the padlock and look at the cert info. It's fine, and a trusted CA.

The issue is that OS X is having trust issues with "Cybertrust Public SureServer EV CA"

A quick Google search reveals that this has been an issue for years. Given it would seem an easy fix, there rather appears to be some reason Apple isn't trusting these certs.

I wouldn't worry about it at all, your connection is secure and every indication is that is the cert that Target is genuinely using. Just be sure to manually check the cert each time you go to the website to make sure you really get that cert and the cert looks valid-ish to you!

[nyancat]

---

@longtimelurker wrote:

---

@Kellan wrote:

Actually I went to the Target site in chrome so I could tell you what the issue really is. Google made a decision to not accept one type of older security that is supposed to be retired in 2017. But google decided to not trust these certificats anymore starting in 2015. The reason Target is not switchig certificates yet is because many people still use WinXP and the newer certs dont work with WinXP. Google is really just being a little over zealous. 

Target site has not been hacked and is safe. 

---

Works fine for me in Chrome on Windows (Chrome  40.0.2214.91 m)

---

It isn't a Chrome problem. I noted some more details above. Apple is the one not trusting the cert. If you look at this page: http://support.apple.com/en-gb/HT202858 you can see that the root CA Target is using is not on the trust list.

This cert expires 2015-02-06 so I'm sure Target will get a new cert that Apple is trusting any day now

[nyancat]

For anyone who cared, Target has switched to a cert Apple trusts.