4 ms·

> not only enable HTTPS on our site but also use our own custom EV certificate¹ Their certificate doesn't look EV to me. (I checked both developer. and www.)

by nandhp 11y ago

profmonocle 11y ago
Odd, I'm seeing an EV cert at https://www.washingtonpost.com/ https://www.washingtonpost.com/ (though not at https://developer.washingtonpost.com/ https://developer.washingtonpost.com/)
- cpeterso 11y ago
  It looks like they switched their certs recently. I saw the EV cert in Chrome but not Firefox, but force-reloading the page in Firefox then showed the EV cert.
atmosx 11y ago
Hm, just don't break it to them that the EV CA doesn't say much if you understand how fundamentally broken the CA system is.
- Someone1234 11y ago
  I don't see what one has to do with the other. EV adds value over a domain verified certificate by claiming to verify the identity of the organisation. This is done through a background check when an EV certificate is applied for. So if an organisation uses a non-standard domain (e.g. Microsoft purchased "SpecialXBoxPromotion.net" for some holiday discount) you could still see, via EV, that that organisation controlled that domain. The CA system has a few warts, but Certificate Transparency, revocation lists, and oversight are helping combat that. But none of this helps or hurts EV as a concept either way. The real issue with EV isn't with the EV concept or EV process, it is that end users don't understand EV or why it matters.
  - __jal 11y ago
    Agreed about EV, but claiming that the CA system "has a few warts" is similar to claiming Katrina "flooded over a few houses". I consider the CA model as it exists for browsers fundamentally broken even in a world where everyone configured things perfectly and no bugs exist. It "works" today insofar as (for instance) I don't really fear using my bank, Amazon, etc. But the protection doesn't come because the CA model offers any technically strong way for you to be certain of the identity of the server on the other end. Any assurance you have is based on human factors (thus the push to EV certs - more human verification). I'm pretty sure there isn't more wide-scale cert forgery only because it is more useful to target individuals, and possibly because those who have the ability to forge, say, Google's certs have an interest in not loudly demonstrating how broken the system is. Given the number of root certs in everyone's browser right now from entities completely unknown to the users, I really don't understand how people have more confidence than I do.
    - thetmkay 11y ago
      I'm not going to disagree with you on the CA system (I'd have to understand it more), but aside from being a product of CAs, what is the issue with EV? EV's biggest problem is DV certificate: it's hard to communicate the nuance between "controls Amazon.com" and "controls Amazon". EV's were a positive step forward, especially with the introduction of the CA/B Forum, as after Let's Encrypt DVs only value is as an encryption mechanism (i.e. not as security, see phishing). Those "human factors" are unavoidable - identity is a "human factor". The integrity of EV is down to the integrity of the CA who are regulated (now) by a strict set of guidelines. So the set of CAs who can administer EVs are a much smaller subset of CAs who can give out DVs.
      - atmosx 11y ago
        “This [attack] was extremely sophisticated and critically executed… It was a very well orchestrated, very clinical attack, and the attacker knew exactly what they needed to do and how fast they had to operate. All the IP addresses were from Iran. All the above leads us to one conclusion only: that this was likely to be a state-driven attack” - Melih Abdulhayoglu, Comodo Founder. Comodo is the CA that issued the biggest percentage of certificates worldwide, they even won an award that year or the year after at RSA conference! If you take a closer look though, as Moxie did[1] - we ’re all grateful - you find out that it takes a douchebag with questionable skillset to bring down the entire infrastructure down to it’s knees. It's hilarious and tragic at the same time. [1] https://www.youtube.com/watch?v=pDmj_xe7EIQ https://www.youtube.com/watch?v=pDmj_xe7EIQ
ejcx 11y ago
Their cert used to be an EV cert. I remember this because the address bar looked absurd as an EV cert "The Washington Post" plus the extra iconography associated with an EV cert. It took up a quarter of my URL bar on a small screen macbook. It looks like they are using instart logic, and are on the same cert as a bunch of their other enterprise customers now.
- exelius 11y ago
  > It looks like they are using instart logic, and are on the same cert as a bunch of their other enterprise customers now. Which is a great way to know who Instant Logic's customers are, if you're in the CDN business and looking for customers to poach...
- thetmkay 11y ago
  FYI they had that because EV Certs are tied to the official company name, so if you want a more 'colloquial' name, there's a special field called something like 'doing business as'. Then the displayed green bar says: > Official Business Name (Colloquial Business Name) Which in the case of two very long names...

> not only enable HTTPS on our site but also use our own custom EV certificate¹ Their certificate doesn't look EV to me. (I checked both developer. and www.)

by nandhp 11y ago

> not only enable HTTPS on our site but also use our own custom EV certificate¹ Their certificate doesn't look EV to me. (I checked both developer. and www.)

profmonocle 11y ago

Odd, I'm seeing an EV cert at https://www.washingtonpost.com/ https://www.washingtonpost.com/ (though not at https://developer.washingtonpost.com/ https://developer.washingtonpost.com/)

cpeterso 11y ago
It looks like they switched their certs recently. I saw the EV cert in Chrome but not Firefox, but force-reloading the page in Firefox then showed the EV cert.

atmosx 11y ago

Hm, just don't break it to them that the EV CA doesn't say much if you understand how fundamentally broken the CA system is.

Someone1234 11y ago
I don't see what one has to do with the other. EV adds value over a domain verified certificate by claiming to verify the identity of the organisation. This is done through a background check when an EV certificate is applied for. So if an organisation uses a non-standard domain (e.g. Microsoft purchased "SpecialXBoxPromotion.net" for some holiday discount) you could still see, via EV, that that organisation controlled that domain. The CA system has a few warts, but Certificate Transparency, revocation lists, and oversight are helping combat that. But none of this helps or hurts EV as a concept either way. The real issue with EV isn't with the EV concept or EV process, it is that end users don't understand EV or why it matters.
- __jal 11y ago
  Agreed about EV, but claiming that the CA system "has a few warts" is similar to claiming Katrina "flooded over a few houses". I consider the CA model as it exists for browsers fundamentally broken even in a world where everyone configured things perfectly and no bugs exist. It "works" today insofar as (for instance) I don't really fear using my bank, Amazon, etc. But the protection doesn't come because the CA model offers any technically strong way for you to be certain of the identity of the server on the other end. Any assurance you have is based on human factors (thus the push to EV certs - more human verification). I'm pretty sure there isn't more wide-scale cert forgery only because it is more useful to target individuals, and possibly because those who have the ability to forge, say, Google's certs have an interest in not loudly demonstrating how broken the system is. Given the number of root certs in everyone's browser right now from entities completely unknown to the users, I really don't understand how people have more confidence than I do.
  - thetmkay 11y ago
    I'm not going to disagree with you on the CA system (I'd have to understand it more), but aside from being a product of CAs, what is the issue with EV? EV's biggest problem is DV certificate: it's hard to communicate the nuance between "controls Amazon.com" and "controls Amazon". EV's were a positive step forward, especially with the introduction of the CA/B Forum, as after Let's Encrypt DVs only value is as an encryption mechanism (i.e. not as security, see phishing). Those "human factors" are unavoidable - identity is a "human factor". The integrity of EV is down to the integrity of the CA who are regulated (now) by a strict set of guidelines. So the set of CAs who can administer EVs are a much smaller subset of CAs who can give out DVs.
    - atmosx 11y ago
      “This [attack] was extremely sophisticated and critically executed… It was a very well orchestrated, very clinical attack, and the attacker knew exactly what they needed to do and how fast they had to operate. All the IP addresses were from Iran. All the above leads us to one conclusion only: that this was likely to be a state-driven attack” - Melih Abdulhayoglu, Comodo Founder. Comodo is the CA that issued the biggest percentage of certificates worldwide, they even won an award that year or the year after at RSA conference! If you take a closer look though, as Moxie did[1] - we ’re all grateful - you find out that it takes a douchebag with questionable skillset to bring down the entire infrastructure down to it’s knees. It's hilarious and tragic at the same time. [1] https://www.youtube.com/watch?v=pDmj_xe7EIQ https://www.youtube.com/watch?v=pDmj_xe7EIQ

ejcx 11y ago

Their cert used to be an EV cert. I remember this because the address bar looked absurd as an EV cert "The Washington Post" plus the extra iconography associated with an EV cert. It took up a quarter of my URL bar on a small screen macbook. It looks like they are using instart logic, and are on the same cert as a bunch of their other enterprise customers now.

exelius 11y ago
> It looks like they are using instart logic, and are on the same cert as a bunch of their other enterprise customers now. Which is a great way to know who Instant Logic's customers are, if you're in the CDN business and looking for customers to poach...
thetmkay 11y ago
FYI they had that because EV Certs are tied to the official company name, so if you want a more 'colloquial' name, there's a special field called something like 'doing business as'. Then the displayed green bar says: > Official Business Name (Colloquial Business Name) Which in the case of two very long names...