4 ms·
Users still have trouble understanding what HTTPS entails. I work with security and most lay-people think it ensures the site is somehow trustworthy. "Why are
by BoppreH 11y ago
Users still have trouble understanding what HTTPS entails. I work with security and most lay-people think it ensures the site is somehow trustworthy.
"Why are you typing your password on faceb00k.com?"
"It has a green padlock, it's safe."
I don't have any suggestions for this problem, but I think it should be acknowledged at least.
- Laaw 11y agoIn theory, at least, a fraud website like faceb00k.com wouldn't be able to maintain a green padlock for very long because the issuer will revoke the cert. Not saying that's a solution, but it mitigates the problem somewhat.
- BoppreH 11y agoAre you sure that happens in practice? Unless you have an Extended Validation certificate, which verifies the company name, I'm not aware of any requirement against fraudulent uses, or precedent of certificates revoked because of that. I know certificates must be revoked if the private key leaks (e.g. Heartbleed), but who is policing certificate use? Is there any place to send complaints? Can I email StartSSL or VeriSign and ask them to revoke faceb00k.com?
- whacker 11y agoand what if they simply get a certificate from another source?!
- Laaw 11y ago> Can I email StartSSL or VeriSign and ask them to revoke faceb00k.com? I think so, yes. I don't have any direct evidence to back this, but my intuition is yes, they would contact the intermediary cert issuer and request the certificate be revoked due to the fraud (assuming Verisign or StartSSL were in the trust chain of the cert). Check out Trustico's website [0], where they say "Your domain name may be blacklisted and internet users will be wary to transact with your web site." [0] - https://www.trustico.com/fraud/fraud.php https://www.trustico.com/fraud/fraud.php