4 ms·
Anyone concerned with the amount of fraud that will come from this? Won't bad actors utilize this to https all of their phishing sites?
by flavmartins 11y ago
Anyone concerned with the amount of fraud that will come from this? Won't bad actors utilize this to https all of their phishing sites?
- foldor 11y agoWhat benefit would a phishing site have with https that they didn't have without it?
- GavinMcG 11y agoThe green padlock that casual users might misinterpret as meaning "to be trusted".
- flavmartins 11y agoIf you look at Chrome's change to https indicators, they give these sites with auto issued certs the lock so users will interpret it as "secure". Seems easy to create fraud sites and give them a legitimate site look.
- schoen 11y agoAlso discussed at https://community.letsencrypt.org/t/the-cas-role-in-fighting-phishing-and-malware/2409 https://community.letsencrypt.org/t/the-cas-role-in-fighting... which is the official discussion thread for Josh's article on this topic.
- Bedon292 11y agoThese certs are to verify you control the domain name, not that you are who you say you are. Those certificates are much more complicated and expensive. See https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html for more information
- cpeterso 11y agoWhat is the value of checking Google's Safe Browsing API before issuing a certificate when the browser can/should use the same Safe Browsing API to block the phishing website? Move the policy to the user agent.
- blibble 11y agothe vast majority of phishing websites I seem encounter these days are all wrapped in https by cloudflare. seems that letsencrypt unlikely to make the problem any worse!