5 ms·
If you already trust your CA authorities and you already know what domain to expect, then that's not necessary, you only need to check for HTTPS and the domain
by Flimm 11y ago
If you already trust your CA authorities and you already know what domain to expect, then that's not necessary, you only need to check for HTTPS and the domain name.
- rlpb 11y agoChecking the domain name isn't sufficient because some letters look similar to each other and not all users are capable of doing precise string comparison matching in the same way that programmers do. The article has an example - qoogle.com instead of google.com. I bet that a significant number of users would miss this when asked to check.
- leni536 11y agoHow does it differ from checking the domain name in the certificate? I don't get it.
- rlpb 11y agoIt doesn't differ from checking the domain name in the certificate. It does differ from checking the entity in the EV certificate, which is generally the legal name of the company. In theory, a phisher could register a company with a similar name to the target website's legal name, obtain a valid EV certificate for that, and then phish using a similar looking domain with a similar looking EV certificate legal name. In practice, if that were to begin happening, I'd like to think that the authorities in charge of legal entity registration (eg. Companies House in the UK) would start requiring identity checks for the legal entity registrations, and then phishers would not have an easy path to exploit this route.
- leni536 11y agoThe discussion started with only mentioning DV certificates. > I'd like to think that the authorities in charge of legal entity registration (eg. Companies House in the UK) would start requiring identity checks for the legal entity registrations Wait, they don't require that now?